TLS Configuration Audit
Enter a host (optionally host:port) to test its TLS service for the classic, named TLS/SSL vulnerabilities — Heartbleed, POODLE, DROWN, FREAK, Logjam, Sweet32, BEAST and CCS Injection — and to check whether its certificate has been revoked (OCSP and CRL). Every check is a single, benign, read-only TLS handshake: the scanner only offers a weak option and reports a flaw when the server accepts it; no exploit payload is ever run. This focuses purely on known-vulnerability findings — for the protocol/cipher A–F grade, use the Deep TLS Audit.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Heartbleed (CVE-2014-0160) — the OpenSSL heartbeat memory over-read (deep mode)
- POODLE (SSLv3 enabled) and DROWN (SSLv2 enabled)
- FREAK and Logjam — export-grade RSA / Diffie-Hellman, plus weak (<2048-bit) DH groups
- Sweet32 (64-bit-block 3DES) and BEAST (TLS 1.0 CBC)
- CCS Injection (CVE-2014-0224) and whether TLS_FALLBACK_SCSV downgrade protection is honoured (deep mode)
- Certificate revocation via a live OCSP query and the issuer's CRL
- The active JARM TLS fingerprint, to correlate a CDN edge with the real origin (deep mode)
How to read the result
- OK = none of the tested vulnerabilities were detected and the certificate is not revoked.
- Critical (fail) = a high-impact flaw is confirmed — Heartbleed, DROWN, FREAK, Logjam export, or a revoked certificate. Patch or replace immediately.
- Warn = a weaker issue is present — SSLv3/POODLE, Sweet32 3DES, a sub-2048-bit DH group, or a tolerated early CCS. Harden the configuration.
- Run with the deep option to add the Heartbleed, CCS Injection and JARM probes — they touch protocol state, so they are opt-in and take a little longer.
- A revoked certificate (OCSP or CRL) is reported separately from the protocol flaws — a revoked cert must be reissued, not just reconfigured.
Frequently asked questions
How is this different from the Deep TLS Audit?
The Deep TLS Audit grades the overall TLS configuration A–F — which protocol versions and cipher suites the server offers. This tool focuses only on the named, known vulnerabilities (Heartbleed, POODLE, DROWN, FREAK, Logjam, Sweet32, BEAST, CCS) and certificate revocation, and reports them on their own, like an SSL Labs 'Known Vulnerabilities' panel. Both run on the same engine.
Is the Heartbleed test safe — does it read leaked memory?
No. The Heartbleed probe is engineered so it cannot capture leaked memory: it sends a heartbeat that claims a small payload, then reads only the 3-byte response header (the echoed length) and closes the connection. It decides purely from that length field; the bytes a vulnerable server would leak are never read into the scanner at all.
Why are Heartbleed and CCS Injection only in deep mode?
Those two probes touch the TLS protocol state more than a simple offer-and-observe handshake, so they are gated behind the deep option to keep the default scan fast and lightweight. POODLE, DROWN, FREAK, Logjam, Sweet32 and BEAST run in every scan.
Does it check whether my certificate is revoked?
Yes. It sends a live OCSP request to the certificate's responder and, as a complement/fallback, fetches the issuer's CRL and checks the certificate's serial against it. A 'revoked' result is reported as critical — reissue the certificate immediately.
Can I scan a non-standard port?
Yes — enter host:port (for example mail.example.com:993) to test TLS on any port, not just 443.