Enter the hostname
The scanner connects to port 443 (or the port in the URL).
Test a Site's SSL Certificate and TLS Configuration
Checks the certificate chain, hostname match, expiry, key strength and signature algorithm, then tests which TLS versions and cipher families the server still negotiates.
Public hosts only. About a handful of requests, usually finished in under 15 seconds. How we scan · Acceptable use
Scanning…
First results
The full scan is still running
How it works
Five handshakes
One verified connection, then one per protocol version and one per weak cipher family.
Fix what fails
Every finding links to the configuration change that resolves it.
What this tool checks
12 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.
Transport security (HTTPS / TLS)
12 checksThe ones that most often decide the grade:
Critical
HTTPS is availableThe site could not be reached over HTTPS on port 443, or the TLS handshake failed. Everything it serves travels in...
High
HTTP redirects to HTTPSPort 80 serves page content instead of redirecting to HTTPS, or the redirect chain is wrong. Visitors who type the...
High
Deprecated TLS versions accepted (1.0 / 1.1)The server still completes handshakes with TLS 1.0 or TLS 1.1. Both were formally deprecated by RFC 8996 in 2021 and...
Critical
Certificate chain and hostname validationThe certificate presented for this hostname did not validate: The chain does not reach a trusted root, an...
High
Certificate expiryThe certificate has expired or will expire within 30 days. Once it lapses every browser, API client and mail gateway...
Medium
Strict-Transport-Security (HSTS)The HTTPS response carries no Strict-Transport-Security header, or its max-age is too short to protect returning...
Info
HSTS preload eligibilityThe domain does not yet meet the requirements for the browser HSTS preload list. Preloading is optional, so this is...
Low
TLS 1.3 supportThe server negotiates TLS 1.2 at best and does not offer TLS 1.3. This is not a vulnerability on its own, but it...
Medium
Certificate key strengthThe certificate's public key is weaker than current guidance: An RSA key shorter than 2048 bits, or a DSA key. Such...
Medium
Certificate signature algorithmA certificate in the chain is signed with SHA-1, MD5 or another broken hash. Browsers reject SHA-1-signed...
Medium
Weak cipher suites acceptedThe server is willing to negotiate legacy cipher suites such as RC4, 3DES, export-grade, NULL or anonymous suites,...
Info
HTTP/2 supportThe server negotiates only HTTP/1.1 over TLS and does not advertise HTTP/2. This is a performance and modernity...
What an SSL and TLS checker verifies
The check separates certificate identity from the protocol and cipher configuration used to protect each connection.
A padlock is not a single test. The certificate must be trusted, valid for the requested hostname, within its validity period and accompanied by the intermediate certificates needed to build a trusted chain. The server must also negotiate modern TLS versions and avoid weak cipher families.
Scan.now opens several bounded TLS connections to the hostname. One validates the ordinary connection and certificate chain; the others ask whether specific obsolete protocols or weak cipher families are still accepted. This shows what the server permits, not merely what a modern browser chooses by default.
Resolve the hostConnect to the hostname and port in the entered address.
Negotiate TLSValidate the certificate and test selected protocol and cipher families.
Explain failuresSeparate identity, expiry, trust and configuration problems.
Put this result in context
This scanner answers one part of the review. Continue with Website Scanner for headers, tls, cookies, exposed files, then LLM API Key Scanner for openai, anthropic, gemini and other ai keys. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.
For the background behind these signals, read SSL and TLS Explained: Certificates, Handshakes, Protocol Versions and Cipher Suites and TLS Certificate Errors Explained: Expired, Mismatched, Self-Signed and Untrusted Chains. The HTTPS is available check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.
SSL certificate and TLS checks explained
These signals answer different questions and usually require different fixes.
| Check | What is tested | Typical corrective action |
|---|---|---|
| Hostname and trust | Whether the certificate covers the requested name and chains to a public trust anchor. | Issue the certificate for the correct names and install the complete intermediate chain. |
| Validity period | Start date, expiry date and the number of days remaining. | Repair automated renewal and alert well before expiry. |
| Key and signature | Public-key strength and the certificate signature algorithm. | Replace obsolete keys or signatures during the next certificate issuance. |
| Protocol support | Whether TLS 1.0, TLS 1.1, TLS 1.2 and TLS 1.3 can be negotiated. | Disable deprecated protocols while retaining supported modern clients. |
| Weak cipher families | Acceptance of known weak, anonymous, export, NULL or obsolete cipher families. | Use the platform's current recommended TLS policy. |
What the TLS result means
A valid certificate and a modern server policy are both required for a strong result.
Valid and modern
The hostname, trust chain and dates validate, and the tested obsolete protocol and cipher families are refused.
Connection risk
A name mismatch, expired certificate, broken chain or accepted obsolete transport setting can expose visitors or break clients.
Operational warning
An approaching expiry or incomplete observation may not be a vulnerability today, but it needs ownership and a renewal plan.
Improve and maintain TLS
- Automate certificate issuance and renewal, then monitor the public endpoint rather than only the certificate store.
- Use the current recommended TLS profile from your web server, CDN or load balancer vendor.
- Test every public hostname because certificates and edge policies can differ between aliases.
- Retest after CDN, proxy, certificate or load-balancer changes.
What this result does not prove
- The bounded check does not enumerate every cipher suite or every client-specific handshake combination.
- A CDN result describes the edge server reached by Scan.now, not an origin server hidden behind it.
- Private PKI, mutual TLS and internal-only endpoints require testing from an authorised network environment.
Related tools
Continue the review with four checks that cover adjacent parts of the same attack surface.
Website Vulnerability Scanner
Headers, TLS, cookies, exposed files
LLM API Key Exposure Scanner
OpenAI, Anthropic, Gemini and other AI keys
Security Headers Checker
CSP, HSTS, frame and MIME policies
Email Security Checker (SPF, DKIM, DMARC)
SPF, DKIM, DMARC and MX records
Guides for this tool
Background reading written to go with these results.
9 min read · Updated Sep 18, 2026
SSL and TLS Explained: Certificates, Handshakes, Protocol Versions and Cipher Suites
TLS is the protocol behind the padlock. What a certificate proves, how the handshake works, why TLS 1.0 and 1.1 are retired, what a...
Read the guide
8 min read · Updated Sep 18, 2026
TLS Certificate Errors Explained: Expired, Mismatched, Self-Signed and Untrusted Chains
A certificate warning means the browser could not prove it is talking to the right server. Each error, what causes it on the server...
Read the guide
8 min read · Updated Sep 17, 2026
HSTS Explained: Strict-Transport-Security, Preloading and the Downgrade Attacks It Stops
HTTP Strict Transport Security tells the browser to never load a site over plain HTTP again. The header, max-age and includeSubDomains,...
Read the guide
7 min read · Updated Sep 14, 2026
HTTPS-Only Mode: What It Protects and Why You Should Turn It On
HTTPS-Only mode makes the browser refuse plain HTTP connections unless you explicitly allow them. What an unencrypted connection...
Read the guide
8 min read · Updated Sep 08, 2026
Mixed Content: Why an HTTPS Page Loading HTTP Resources Is Still Insecure
Mixed content is an HTTPS page that pulls in scripts, images or forms over plain HTTP. Active versus passive mixed content, what...
Read the guideFrequently asked questions
What does 'chain validates' mean?
The server's certificate was issued by an authority in the public trust store, every intermediate was presented, nothing is expired and the name matches the hostname.
Why is TLS 1.0 still flagged if browsers already refuse it?
Because other clients do not: old API consumers, embedded devices and downgrade attacks all depend on the server still speaking it. RFC 8996 deprecated both 1.0 and 1.1.
Can you test every cipher suite?
We test the families that matter (RC4, 3DES, NULL, export, anonymous, static RSA) rather than enumerating hundreds of suites. For a complete list run testssl.sh.
My certificate expires in 20 days. Is that a problem?
Only if renewal is manual. Automated issuers renew at 30 days; a manual certificate at 20 days needs attention now.
