Free Security Tool

SSL/TLS Certificate Grader

Instantly test your SSL/TLS configuration. Get an A-F grade covering certificate validity, protocol versions, cipher suites, and more. No signup required.

How an SSL/TLS checker tests your certificate

An SSL checker (also called a TLS checker or SSL certificate checker) connects to your server over HTTPS the same way a browser does, then inspects the certificate and the encrypted handshake it negotiates. It reads the certificate chain, the protocol versions your server offers, the cipher it agrees on, and the security headers that harden the connection. From those signals it produces a single A to F grade so you can see at a glance whether the configuration is safe.

The check is passive and read only. It does not send attack traffic or attempt to break anything, so it is safe to run against any host you own. Use it as a fast TLS 1.3 test site: enter a domain and the result shows exactly which protocol versions, from the deprecated TLS 1.0 and 1.1 to the current TLS 1.2 and 1.3, your server will accept.

How to read your SSL/TLS test results

  • Certificate validity: the expiry date, issuing authority, and whether the chain is complete and trusted. An expired or self signed certificate fails the grade outright.
  • Protocol support: which TLS versions the server offers. You want TLS 1.2 and TLS 1.3 enabled and TLS 1.0 and 1.1 switched off.
  • Cipher strength: the negotiated cipher suite and whether it provides forward secrecy through ECDHE or DHE key exchange. Weak or export ciphers drag the grade down.
  • Signature and key: the certificate signature algorithm and key size. SHA-1 or MD5 signatures and undersized keys are flagged as insecure.

How to fix a failing SSL/TLS grade

  • Use a trusted certificate. A free automated certificate from Let's Encrypt is trusted by every major browser and renews every 90 days.
  • Enable only TLS 1.2 and 1.3. Disable TLS 1.0 and 1.1, which were deprecated in 2020 because of the BEAST and POODLE weaknesses.
  • Prefer strong ciphers with forward secrecy. Turn off RC4, DES, and 3DES, and put ECDHE suites at the top of your cipher order.
  • Add HSTS. The Strict-Transport-Security header forces HTTPS on future visits and prevents protocol downgrade attacks. Check it alongside your other headers with the free security header checker.

Certificate strength is one control among many. A free External Security Check shows how your TLS configuration maps to the Essential Eight, SOC 2, and ISO 27001 controls it touches, so you know which findings carry audit weight.

Frequently asked questions

What is a TLS checker?

A TLS checker connects to a server over HTTPS and reports the certificate details, the TLS versions offered, and the cipher negotiated, then grades the configuration. It is the same as an SSL checker: TLS is the modern name for the protocol once called SSL.

How do I test if a site supports TLS 1.3?

Enter the domain above and read the Protocol Support panel. It lists TLS 1.0, 1.1, 1.2, and 1.3 with a clear supported or not supported status for each, so you can confirm TLS 1.3 in one test.

What TLS version should I use?

Enable TLS 1.2 and TLS 1.3 and disable TLS 1.0 and 1.1. TLS 1.3 is the current version with a faster handshake and stronger defaults. TLS 1.0 and 1.1 were deprecated in 2020.

How do I get an A grade on the SSL test?

Use a trusted certificate, offer only TLS 1.2 and 1.3, disable weak ciphers such as RC4 and 3DES, prefer ECDHE suites for forward secrecy, enable HSTS, and serve a complete certificate chain.

How often should I check my SSL certificate?

Check at least monthly, or set up continuous monitoring. Automated certificates such as Let's Encrypt expire every 90 days, and a failed renewal is a common cause of outages.