Tools / TLS Checker
How well does your server do HTTPS?
The padlock only says a certificate exists. This test asks the server what it will actually agree to: which protocol versions, which cipher suites, which key exchange, and whether the certificate chain is one every client will trust. The result is the familiar A+ to F grade, with every mark explained.
Certificate · SSL 2/3 · TLS 1.0–1.3 · Cipher suites · Forward secrecy · Key exchange · OCSP · ALPN · HSTSFree · No sign-up · PDF report
What it checks
Certificate
Trust against the Mozilla root store, host-name match, expiry, key type and size, signature algorithm, whether the intermediate is sent, and OCSP stapling.
Protocols
SSL 2.0, SSL 3.0, TLS 1.0, 1.1, 1.2 and 1.3, each asked for directly with its own ClientHello so the answer is the server's, not a library's.
Cipher suites
Every suite the server will negotiate on each protocol, enumerated one handshake at a time: NULL, export, DES, RC4, 3DES, anonymous and MD5 suites, CBC versus AEAD, forward secrecy, and whether the server enforces its own order.
Key exchange
The ephemeral curve or Diffie-Hellman group actually used, with Logjam-class 1024-bit groups called out, and the certificate key strength.
Handshake features
Secure renegotiation (RFC 5746), TLS compression (CRIME), the heartbeat extension, and HTTP/2 over ALPN.
The grade
Protocol support, key exchange and cipher strength scored and weighted 30/30/40 as SSL Labs does, then capped for the things that matter most: untrusted certificates, SSL 3, TLS 1.0 and 1.1, RC4, 3DES, missing forward secrecy. HSTS turns an A into an A+.
What it does not do
The checker reports what the server offers; it does not attempt exploits. It will tell you that the heartbeat extension is enabled, not whether the library is vulnerable to Heartbleed, and that 3DES is enabled, not run SWEET32 against it. For a server that handles anything sensitive, those questions belong in a penetration test, where the answer comes with a person who can explain it.
It tests port 443 on the name you give, so a load balancer in front of several servers may answer differently from one run to the next, and a CDN edge will show the CDN’s configuration rather than the origin’s. Results are cached for ten minutes.