Free Security Tool

SSL/TLS Certificate Grader

Grade your certificate, TLS versions and ciphers from A to F. No signup.

Get the full picture for your domain

Free recon check of your external footprint: headers, TLS, DNS, subdomains and CVE signals. Your report and a PDF summary, sent to your work email on that domain.

Free External Security Check

How an SSL/TLS checker tests your certificate

An SSL checker (also called a TLS checker or SSL certificate checker) connects over HTTPS the way a browser does, then reads the certificate chain, the protocol versions offered, the negotiated cipher and the headers that harden the connection, and turns them into one A to F grade.

It is passive and read only: no attack traffic, so it is safe against any host you own. Use it as a quick TLS 1.3 test site, since the result lists which of TLS 1.0, 1.1, 1.2 and 1.3 your server accepts.

How to read your SSL/TLS test results

  • Certificate validity: expiry, issuer and whether the chain is complete and trusted. Expired or self-signed fails outright.
  • Protocol support: you want TLS 1.2 and 1.3 on, TLS 1.0 and 1.1 off.
  • Cipher strength: the negotiated suite and whether it gives forward secrecy (ECDHE or DHE). Weak or export ciphers drag the grade down.
  • Signature and key: SHA-1 or MD5 signatures and undersized keys are flagged as insecure.

How to fix a failing SSL/TLS grade

  • Use a trusted certificate. Let's Encrypt is free, trusted by every major browser and renews every 90 days.
  • Enable only TLS 1.2 and 1.3. TLS 1.0 and 1.1 were deprecated in 2020 (BEAST, POODLE).
  • Prefer strong ciphers with forward secrecy. Turn off RC4, DES and 3DES; put ECDHE suites first.
  • Add HSTS. It forces HTTPS on future visits. Check it with the security header checker.

Frequently asked questions

What is a TLS checker?

A tool that connects to a server over HTTPS and reports the certificate details, the TLS versions offered and the cipher negotiated, then grades the configuration. It is the same as an SSL checker: TLS is the modern name for the protocol once called SSL.

How do I test if a site supports TLS 1.3?

Enter the domain above and read the Protocol Support panel. It lists TLS 1.0, 1.1, 1.2 and 1.3 with a supported or not supported status for each.

What TLS version should I use?

Enable TLS 1.2 and TLS 1.3 and disable TLS 1.0 and 1.1. TLS 1.3 is the current version, with a faster handshake and stronger defaults. TLS 1.0 and 1.1 were deprecated in 2020.

How do I get an A grade on the SSL test?

Use a trusted certificate, offer only TLS 1.2 and 1.3, disable weak ciphers such as RC4 and 3DES, prefer ECDHE suites for forward secrecy, enable HSTS, and serve a complete certificate chain.

How often should I check my SSL certificate?

At least monthly, or set up continuous monitoring. Automated certificates such as Let's Encrypt expire every 90 days, and a failed renewal is a common cause of outages.