TLS version checker

How this is actually tested

Rather than reading a claimed configuration, this attempts a real handshake with each TLS version forced in turn and records whether the server completes it or refuses it. That is the only way to know what a server genuinely accepts, as distinct from what it is documented or believed to accept.

Why old versions matter

TLS 1.0 and 1.1 are formally deprecated - major browsers stopped supporting them years ago, and they carry known weaknesses (BEAST, POODLE-adjacent issues) that TLS 1.2 and 1.3 do not. A server that still accepts them is not necessarily actively exploited, but it is offering a weaker option to anything willing to negotiate down to it.

Reading "not offered by this checker's environment"

This is an honest limitation, not a finding about the target server: modern operating systems increasingly disable old TLS versions at the OS level for outgoing connections, which means the checker itself may be unable to even attempt the handshake regardless of what the server would have accepted. That result is reported as unverified, never folded into a false "not supported."

Related tools

See SSL/TLS configuration checker for this alongside the certificate itself, or SSL security checker for a broader checklist.