SSL security checker

A checklist, deliberately not a single score

Every row here is either Pass, Fail, or Not verified - and the summary count only divides by checks that actually ran, listing separately how many could not be tested from this environment. A single manufactured percentage that quietly includes skipped checks as failures (or worse, as passes) would be easy to produce and would mean nothing.

What is checked

• The certificate is not expired.
• The certificate chain builds without errors.
• The certificate is not self-signed.
• The signature algorithm is not SHA-1.
• TLS 1.0 and TLS 1.1 are disabled (only counted when this checker's own environment was able to actually attempt the handshake - see the TLS version checker for why that sometimes cannot be tested).
• TLS 1.2 or 1.3 is supported.
• An HSTS header is present.

What this is not

Not a penetration test, not a vulnerability scanner, and not a substitute for a proper security review before something security-critical goes live. It is exactly what it says: a handful of specific, individually-checkable facts about how a server's TLS is currently configured.

Related tools

See SSL/TLS configuration checker for the same underlying data laid out as reference rather than pass/fail, and HSTS checker for that header's full detail.