Skip to content
Noroxi

SSL checker: certificate and TLS test

SSL/TLS check

Checks your certificate’s validity and chain, the TLS versions you have enabled and whether weak cipher suites are accepted, and lists outdated or weak settings with steps to fix them.

Sample results:

How the scan works and how many you get

The domain you enter is really scanned: only public information is read (HTTP headers, the page and the scripts it loads, TLS handshake, DNS, certificate logs). The result is saved (the same domain isn’t rescanned within 10 minutes); 3 scans per day without an account, 10 per hour with a free account.

What does this test do?

An SSL/TLS check tests your site's HTTPS connection the way a browser sees it: is the certificate valid and when does it expire, is the chain complete, does it match the domain, are legacy TLS 1.0/1.1 or weak ciphers still accepted. It works with TLS handshakes and a single header request only.

Sources and method

Reads the certificate and protocols through TLS handshakes; sends a single header request to the home page to check the HTTP→HTTPS redirect. It doesn’t fill in forms or generate load.

What it checks and how to fix it

Every item the test looks at, why it matters and what to do if it is missing. The result screen lists only the gaps found on your site.

Certificate validity

An expired certificate puts your site behind a browser warning for every visitor. It’s the most common outage, and the easiest to prevent.

How to fix it

Set up automatic renewal and add monitoring that alerts you 21 days before expiry.

certbotbash
$ sudo certbot renew --dry-run

Certificate chain

If the intermediate certificate is missing, desktop browsers often fill the gap, but mobile apps, API clients and some Android versions reject the connection.

How to fix it

Serve the full chain from your server, including the intermediate certificate, not just the site certificate.

nginx
ssl_certificate     /etc/ssl/fullchain.pem;ssl_certificate_key /etc/ssl/privkey.pem;

Hostname match

If the names on the certificate don’t match your domain, the browser treats the connection as insecure.

How to fix it

Include both the apex domain and www on the certificate.

Legacy protocols (TLS 1.0 / 1.1)

TLS 1.0 and 1.1 have known weaknesses and have been disabled in all major browsers since 2020. Leaving them on only opens the door to old, insecure clients.

How to fix it

Enable only TLS 1.2 and 1.3.

nginx
ssl_protocols TLSv1.2 TLSv1.3;

TLS 1.3 support

Faster handshakes and only strong cipher suites. Enabling it usually takes a single line.

How to fix it

With OpenSSL 1.1.1 or later, add TLSv1.3 to the ssl_protocols line.

Weak cipher suites

3DES and RSA key exchange without forward secrecy allow traffic to be weakened or decrypted later.

How to fix it

Allow only ECDHE-based AEAD cipher suites.

nginx
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;ssl_prefer_server_ciphers off;

HTTP to HTTPS redirect

If the HTTP version serves content, users can sign in on an unencrypted page and the connection can be tampered with.

How to fix it

Redirect every request on port 80 to HTTPS with a 301.

nginx
server {  listen 80;  return 301 https://$host$request_uri;}

OCSP stapling

The browser doesn’t need to check the certificate’s revocation status separately, so connections are faster and visitor information isn’t sent to the certificate authority.

How to fix it

Enable stapling on your server.

nginx
ssl_stapling on;ssl_stapling_verify on;

CAA record

Restricts in DNS which certificate authorities may issue certificates for your domain, making unauthorized issuance harder.

How to fix it

Add the certificate authority you use to DNS as a CAA record.

dns
alanadiniz.com.  IN  CAA  0 issue "letsencrypt.org"

Quick checks

One question, one answer: is my SPF record right, is the site down, when does my certificate expire? They don't use your daily scan allowance and need no account.

Frequently asked questions

How do I check when my SSL certificate expires?
Enter your domain; the result shows the certificate's expiry date and the days left. To be warned before it expires, add the site to monitoring with a free account and you will get an email ahead of expiry.
Should TLS 1.0 and 1.1 be disabled?
Yes. No current browser uses them, and leaving them on only keeps known weaknesses reachable. Allow TLS 1.2 and 1.3 only.
Is it free? Do I need an account?
Yes, it is free and needs no account: without one you get 3 scans a day (shared by all free tools and the scorecard). A free account raises this to 10 scans an hour (at most 30 a day) and keeps your results and history.
Is it safe to run on my site?
The light scan only reads public information (DNS, the TLS handshake, the HTTP response, certificate logs); it fills in no forms, guesses no passwords and exploits nothing. Each tool lists exactly what it reads under "Sources and method".

Primary sources

Other tests

  • Email security

    Reads your SPF, DKIM and DMARC records to tell you whether someone can send fake email in your name.

  • Security headers test

    Grades the security settings your site sends to browsers (HSTS, CSP, cookie flags) and lists what is missing.

  • DNS and domain security

    Checks when your domain expires, whether the transfer lock is on and whether your DNS records are protected (DNSSEC, CAA).

  • Cookie and consent check

    Shows whether trackers such as Google Analytics or Meta Pixel load before the visitor consents.

  • JavaScript library vulnerabilities

    Finds jQuery, Bootstrap and other libraries on your site, flags versions with known vulnerabilities and names the safe one.

  • Subdomain finder

    Finds your subdomains and flags forgotten records that someone else could take over.

  • Attack surface scan

    Collects what an attacker can learn about you from public sources: subdomains, the software you run, DNS.

Other free scanners

  • WP Lens: WordPress scan

    Matches the versions of WordPress core, plugins and themes against known vulnerabilities.

  • Port scan

    Finds the ports your server exposes and their service versions, and matches them against known vulnerabilities. Runs only with your confirmation.

  • Dependency scan (SBOM)

    Matches the dependencies in your package-lock, yarn.lock or SBOM file against known vulnerabilities.

  • Banner to CVE

    Paste a service version line and see the known vulnerabilities of that version. No scanning.