Deep TLS Audit
Enter a host (optionally host:port) to inspect its TLS configuration the way SSL Labs does: which protocol versions it offers (TLS 1.0, 1.1, 1.2, 1.3), the cipher it negotiates on each, whether it still accepts weak legacy ciphers (RC4/3DES), and an overall A–F grade. This complements the certificate checker — it grades how the server speaks TLS, not just its cert.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Which TLS protocol versions the server supports (1.0/1.1/1.2/1.3)
- The cipher suite negotiated on each supported version
- Whether the server still accepts weak legacy ciphers (RC4, 3DES)
- An overall A–F grade, plus the certificate's subject and expiry
How to read the result
- A = modern: TLS 1.2 and 1.3, no weak ciphers or obsolete protocols.
- B = TLS 1.2 or 1.3 but missing one of them — enable both.
- F = obsolete TLS 1.0/1.1 enabled, weak ciphers accepted, or no usable modern TLS.
- Disable TLS 1.0/1.1 and RC4/3DES, and enable TLS 1.3, to reach an A.
Frequently asked questions
How is this different from the SSL Certificate Checker?
The certificate checker validates the cert (chain, expiry, hostname, auto-renew). The deep TLS audit grades the server's TLS configuration — which protocol versions and ciphers it offers — which is what determines whether modern clients connect securely.
Why is TLS 1.0/1.1 a problem?
They're obsolete and have known weaknesses; browsers and PCI DSS reject them. Set your minimum protocol to TLS 1.2 and enable TLS 1.3.
What are weak ciphers?
Legacy ciphers like RC4 and 3DES (and old CBC suites) that are cryptographically weak. Offer only AEAD suites — AES-GCM and ChaCha20-Poly1305.
Can I scan a non-standard port?
Yes — enter host:port (e.g. mail.example.com:993) to scan TLS on any port, not just 443.