scan.now
Premium Scan a site

Test a Site's SSL Certificate and TLS Configuration

Checks the certificate chain, hostname match, expiry, key strength and signature algorithm, then tests which TLS versions and cipher families the server still negotiates.

Public hosts only. About a handful of requests, usually finished in under 15 seconds. How we scan · Acceptable use

Illustration of the ssl / tls checker in use

How it works

  1. Enter the hostname

    The scanner connects to port 443 (or the port in the URL).

  2. Five handshakes

    One verified connection, then one per protocol version and one per weak cipher family.

  3. Fix what fails

    Every finding links to the configuration change that resolves it.

What this tool checks

12 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Transport security (HTTPS / TLS)

12 checks

The ones that most often decide the grade:

Critical HTTPS is availableThe site could not be reached over HTTPS on port 443, or the TLS handshake failed. Everything it serves travels in... High HTTP redirects to HTTPSPort 80 serves page content instead of redirecting to HTTPS, or the redirect chain is wrong. Visitors who type the... High Deprecated TLS versions accepted (1.0 / 1.1)The server still completes handshakes with TLS 1.0 or TLS 1.1. Both were formally deprecated by RFC 8996 in 2021 and... Critical Certificate chain and hostname validationThe certificate presented for this hostname did not validate: The chain does not reach a trusted root, an... High Certificate expiryThe certificate has expired or will expire within 30 days. Once it lapses every browser, API client and mail gateway...

Wondering how this stacks up against the tool you already use? We wrote up how this compares with SSL Labs, including the things it does better than us.

After this one, most people run Website Scanner, Security Headers, or Email (SPF, DKIM, DMARC). Each answers a different question about the same thing, and the full list of tools explains which to reach for when. Every finding links through to the checks reference.

Guides for this tool

Background reading written to go with these results.

9 min read · Updated Sep 18, 2026 SSL and TLS Explained: Certificates, Handshakes, Protocol Versions and Cipher Suites

TLS is the protocol behind the padlock. What a certificate proves, how the handshake works, why TLS 1.0 and 1.1 are retired, what a...

Read the guide 8 min read · Updated Sep 18, 2026 TLS Certificate Errors Explained: Expired, Mismatched, Self-Signed and Untrusted Chains

A certificate warning means the browser could not prove it is talking to the right server. Each error, what causes it on the server...

Read the guide 8 min read · Updated Sep 17, 2026 HSTS Explained: Strict-Transport-Security, Preloading and the Downgrade Attacks It Stops

HTTP Strict Transport Security tells the browser to never load a site over plain HTTP again. The header, max-age and includeSubDomains,...

Read the guide 7 min read · Updated Sep 14, 2026 HTTPS-Only Mode: What It Protects and Why You Should Turn It On

HTTPS-Only mode makes the browser refuse plain HTTP connections unless you explicitly allow them. What an unencrypted connection...

Read the guide 8 min read · Updated Sep 08, 2026 Mixed Content: Why an HTTPS Page Loading HTTP Resources Is Still Insecure

Mixed content is an HTTPS page that pulls in scripts, images or forms over plain HTTP. Active versus passive mixed content, what...

Read the guide

Frequently asked questions

What does 'chain validates' mean?

The server's certificate was issued by an authority in the public trust store, every intermediate was presented, nothing is expired and the name matches the hostname.

Why is TLS 1.0 still flagged if browsers already refuse it?

Because other clients do not: old API consumers, embedded devices and downgrade attacks all depend on the server still speaking it. RFC 8996 deprecated both 1.0 and 1.1.

Can you test every cipher suite?

We test the families that matter (RC4, 3DES, NULL, export, anonymous, static RSA) rather than enumerating hundreds of suites. For a complete list run testssl.sh.

My certificate expires in 20 days. Is that a problem?

Only if renewal is manual. Automated issuers renew at 30 days; a manual certificate at 20 days needs attention now.