Skip to main content
11 TLS/SSL Checks · 9 Free

Check SSL Version & TLS Certificate Security Online Free

Check SSL version, certificate expiry, and TLS configuration in one free scan. Verify TLS 1.2/1.3 support, check cipher suite strength, test OCSP stapling, HSTS, and mixed content — 11 checks that SSL Labs doesn't cover in full.

Results in 1–3 minutesMore checks than SSL Labs

Results in 1–3 minutes · Free · No signup required

What is SSL/TLS and Why Does It Matter?

What is SSL?

SSL (Secure Sockets Layer) and its modern successor TLS (Transport Layer Security) are cryptographic protocols that encrypt data between a user's browser and your web server. When a website uses SSL/TLS, the URL starts with https:// and a padlock icon appears in the browser.

An SSL certificate is a digital certificate that authenticates your website's identity and enables encrypted connections. Without a valid SSL certificate, browsers show security warnings that drive away visitors.

Why Run an SSL Test?

  • Catch expiring certs — SSL certificates expire; a lapsed cert triggers browser warnings instantly
  • Verify TLS version — TLS 1.0 and 1.1 are deprecated; you must support TLS 1.2 or 1.3
  • Harden cipher suites — weak ciphers (RC4, 3DES) leave your site vulnerable to attacks
  • Check HSTS — HTTP Strict Transport Security forces browsers to always use HTTPS

How to fix common SSL issues: If your SSL test reveals problems, see our detailed guides on fixing certificate expiry, checking your TLS version, disabling deprecated TLS, enabling HSTS, and hardening cipher suites.

What Does Our SSL Checker Test?

Unlike cert-only tools that grade your TLS score, SecScanner runs 11 distinct checks covering the full SSL/TLS stack — click any check to learn more.

Certificate Expiry

Verifies your SSL certificate is valid and shows days until expiry. Expired certificates instantly trigger browser security warnings that drive away visitors.

Certificate Hostname & Chain

Confirms the certificate covers your domain and that the full certificate chain is trusted. A broken chain causes 'Untrusted certificate' errors even with a valid leaf cert.

TLS Version

Checks that your server supports TLS 1.2 or TLS 1.3 — the only secure protocol versions accepted by modern browsers.

Deprecated TLS Versions

Detects if your server still accepts TLS 1.0 or TLS 1.1 connections. Both are deprecated by the IETF (RFC 8996) and flagged by all major browsers.

Cipher Suite

Analyzes your server's encryption algorithms. Flags weak ciphers (RC4, 3DES, EXPORT) and verifies forward secrecy via ECDHE key exchange.

OCSP Stapling

Checks that your server pre-fetches certificate revocation status and staples it to the TLS handshake — reducing latency and protecting user privacy.

HTTPS Enabled

Confirms your website is accessible over HTTPS and the SSL/TLS certificate is installed and functioning correctly.

HTTP to HTTPS Redirect

Verifies HTTP requests are automatically redirected to HTTPS so all visitors get a secure connection, even if they type 'http://' directly.

HSTS Enabled

Checks for the HTTP Strict Transport Security header, which tells browsers to always use HTTPS for your domain and prevents protocol downgrade attacks.

HSTS Preload Readiness

Evaluates whether your HSTS configuration meets browser preload list requirements — the strongest protection against downgrade attacks.

Mixed Content

Scans for HTTP resources (images, scripts, stylesheets) loaded on HTTPS pages. Mixed content weakens encryption and triggers browser security warnings.

Which Cipher Suites Are Weak, and Which Are Safe?

A scan tells you what your server offers. This tells you what those names mean. Two properties decide whether a suite is safe: forward secrecy(an ECDHE or DHE key exchange, so a stolen private key can't decrypt recorded traffic) and an AEAD cipher(GCM or ChaCha20-Poly1305, rather than CBC).

Cipher suiteTLSVerdictWhy
TLS_AES_128_GCM_SHA256 / TLS_AES_256_GCM_SHA384TLS 1.3StrongAEAD with implicit forward secrecy. TLS 1.3 removed every negotiable weak option, so its five suites are all safe.
TLS_CHACHA20_POLY1305_SHA256TLS 1.3StrongPreferred on hardware without AES-NI — faster than AES-GCM on most mobile CPUs.
ECDHE-RSA-AES128-GCM-SHA256 / ECDHE-ECDSA-AES256-GCM-SHA384TLS 1.2StrongECDHE gives forward secrecy, GCM is AEAD. This is what a hardened TLS 1.2 config should offer.
DHE-RSA-AES256-GCM-SHA384TLS 1.2AcceptableForward secrecy and AEAD, but finite-field DH is slower than ECDHE and needs a ≥2048-bit group to be safe.
AES128-SHA / AES256-SHA (static RSA)TLS 1.2WeakNo forward secrecy: one leaked private key retroactively decrypts every past session. Also CBC, so exposed to padding-oracle classes of attack.
ECDHE-RSA-DES-CBC3-SHA (3DES)TLS 1.2Weak64-bit block cipher — practical birthday-bound collision attack (Sweet32). Disallowed for new use by NIST.
RC4-SHA / RC4-MD5TLS 1.0–1.2WeakBiased keystream, broken in practice. Prohibited in TLS by RFC 7465.
EXP-* / NULL-* / anon DHLegacyWeakExport-grade keys, no encryption, or no authentication — the FREAK and Logjam families. Must never be offered.

Checking your cipher suites from the command line

To confirm a single suite is refused, ask for it explicitly — a healthy server fails the handshake:

# Is 3DES still accepted?
openssl s_client -connect example.com:443 -cipher 'DES-CBC3-SHA' </dev/null

# Which TLS versions answer?
openssl s_client -connect example.com:443 -tls1_2 </dev/null | head -n 3
openssl s_client -connect example.com:443 -tls1_3 </dev/null | head -n 3

That checks one suite per invocation against one host. The scan above enumerates the whole negotiated set, plus the certificate, OCSP stapling and HSTS, and tells you which config line to change. See the cipher suite check for the full remediation guide.

Which SSL/TLS Version Should Your Server Support?

Support TLS 1.2 and 1.3; refuse everything older. Accepting a deprecated version is both a security weakness and a compliance finding.

VersionStatusSpecNotes
TLS 1.3RecommendedRFC 8446 (2018)One round-trip handshake, all weak options removed, forward secrecy mandatory. Support it wherever your stack allows.
TLS 1.2RecommendedRFC 5246 (2008)Still the compatibility floor. Safe only with an AEAD + ECDHE cipher list — TLS 1.2 can also negotiate the weak suites above.
TLS 1.1DeprecatedRFC 4346 (2006)Formally deprecated by RFC 8996 (2021). Removed from all major browsers in 2020. Fails PCI DSS.
TLS 1.0DeprecatedRFC 2246 (1999)Deprecated by RFC 8996. PCI DSS required migration off it by June 2018 — still accepting it is an audit finding.
SSL 3.0 and earlierBrokenRFC 6101Prohibited by RFC 7568. Structurally broken by POODLE; there is no safe configuration.

Full guidance: TLS version check and deprecated TLS versions.

How It Works

1

Enter your website URL in the scanner above

2

We establish a secure connection and analyze your SSL/TLS certificate

3

TLS handshake is tested for version support and cipher strength

4

Certificate chain is validated for completeness and trust

5

You get a detailed report with actionable fix recommendations

SecScanner vs Qualys SSL Labs

Both tools check your TLS configuration. SecScanner goes further — covering security headers, DNS, and content vulnerabilities in the same scan.

SecScanner vs Qualys SSL Labs: feature comparison across SecScanner, SSL Labs
FeatureSecScannerSSL Labs
SSL/TLS checksSupportedSupported
Cipher suite analysisSupportedSupported
Certificate chain checkSupportedSupported
TLS 1.0/1.1 deprecation checkSupportedSupported
OCSP stapling verificationSupportedSupported
HSTS configuration checkSupportedNot supported
Security headers (CSP, X-Frame-Options, etc.)SupportedNot supported
DNS security (SPF, DKIM, DMARC)SupportedNot supported
Content vulnerability scanSupportedNot supported
Actionable fix guidanceSupportedNot supported
Continuous monitoringSupportedNot supported

Frequently Asked Questions

What does this SSL checker test?
Our SSL checker verifies your certificate expiry, TLS version (1.2/1.3), cipher suite strength, certificate chain trust, mixed content issues, HSTS configuration, and OCSP stapling. It covers 11 checks across your entire TLS/HTTPS setup.
What TLS version should my site use?
You should support TLS 1.2 and TLS 1.3 while disabling older versions (TLS 1.0, 1.1, and all SSL versions). TLS 1.3 offers the best security and performance with faster handshakes. Our TLS checker flags any deprecated versions automatically.
How does this compare to Qualys SSL Labs (SSL Test)?
Both tools check TLS configuration, certificate chain, and cipher suites. The key difference: SSL Labs gives you an A–F grade focused purely on TLS, while SecScanner covers TLS plus security headers, DNS security (SPF/DKIM/DMARC), content vulnerabilities, and HSTS — giving you a complete security picture in one scan, typically ready in 1–3 minutes.
How do I check my certificate chain?
Run a scan with SecScanner — the 'Certificate Hostname & Chain' check validates that your entire certificate chain is trusted and complete. A broken chain causes browser 'Untrusted certificate' errors even if your leaf certificate is valid. Common issues include missing intermediate certificates.
How do I check which cipher suites my server supports?
Run the scan above — the cipher suite check reads your TLS handshake and reports the negotiated suites, flagging weak ones (RC4, 3DES, static-RSA CBC, EXPORT). From a terminal you can test one suite at a time with `openssl s_client -connect example.com:443 -cipher 'DES-CBC3-SHA'`; a hardened server refuses the handshake. Aim to offer only AEAD suites (AES-GCM or ChaCha20-Poly1305) with an ECDHE key exchange for forward secrecy.
How do I check my SSL/TLS version?
The scan reports every protocol version your server accepts, from SSL 3.0 through TLS 1.3. Manually, `openssl s_client -connect example.com:443 -tls1_2` (or -tls1_3) tells you whether a specific version is answered. You want TLS 1.2 and TLS 1.3 accepted and TLS 1.0/1.1 refused — RFC 8996 deprecated both, and PCI DSS treats TLS 1.0 as a finding.
Which cipher suites count as weak?
Anything without forward secrecy or without an AEAD cipher. In practice: RC4 (prohibited by RFC 7465), 3DES/DES-CBC3 (Sweet32, a 64-bit block cipher), static-RSA suites such as AES128-SHA (one leaked key decrypts all recorded past traffic), all CBC-mode suites, and EXPORT/NULL/anonymous-DH suites (FREAK, Logjam). The cipher table on this page lists each one with the reason.
Is this a TLS scanner too?
Yes — SecScanner is both an SSL certificate checker and a TLS scanner. It tests TLS 1.0, 1.1, 1.2, and 1.3 support, verifies cipher suite security, checks the TLS handshake, and confirms OCSP stapling is enabled. Everything you'd want from a dedicated TLS checker.
How often should I check my SSL certificate?
We recommend checking monthly. Certificates typically last 90 days (Let's Encrypt) to 1 year. Expired certificates cause browser warnings that drive away visitors. Upgrade to Pro for automated daily or weekly monitoring with email alerts when expiry is approaching.
Is this SSL checker free?
Yes, and your first scan needs no account at all. 9 of these 11 checks are included in every free scan, covering certificate expiry, TLS version, cipher suite strength, mixed content, and HSTS. Certificate Hostname & Chain validation and OCSP Stapling are part of the Pro plan ($19/month), which also adds continuous monitoring with automatic alerts when your certificate is about to expire.
What is OCSP stapling and why does it matter?
OCSP (Online Certificate Status Protocol) stapling lets your server pre-fetch a certificate revocation status from the CA and attach it to the TLS handshake. Without it, browsers must contact the CA directly for every connection — adding latency and a privacy risk. Our scanner verifies OCSP stapling is active on your server.

More Security Tools

SSL is one piece of the puzzle. Explore our other free security checkers.

TLS Checker

Check TLS version, cipher suites & HSTS

Email Security Checker

Test SPF, DKIM & DMARC for your domain

Cookie Security Checker

Verify HttpOnly, Secure & SameSite flags

All Security Tools

Browse all free security scanners

Want the Full Security Picture?

SSL is just the start. Run a full 62-check security audit covering headers, vulnerabilities, DNS, and more.

Start Full Scan