What does the SSL checker test?

It opens TLS connections to port 443 and reads the certificate that the server presents. It checks the expiry date, the hostname match, the signature algorithm, the key size, and the chain. It then tests which protocol versions the server accepts, from TLS 1.0 to TLS 1.3.

How is the SSL grade calculated?

A valid, trusted certificate with more than 30 days left earns the most points. TLS 1.3 support and a strong key earn more. Legacy protocols TLS 1.0 and TLS 1.1, weak signature algorithms, and short keys subtract points. An expired or mismatched certificate fails the check.

Does the checker test cipher suites or known TLS vulnerabilities?

It tests protocol versions and reads the negotiated cipher for each. It does not run exploit probes for Heartbleed, ROBOT, or padding oracles. A Strix pentest covers those and the application behind the certificate.

Scanners

SSL/TLS Checker

Free SSL/TLS checker. Test any domain for certificate validity, expiry date, hostname match, chain issues, and TLS 1.0 to 1.3 support. Get an A+ to F grade and an embeddable badge.

How the grade works

The checker opens one TLS connection to port 443 with a modern client profile and reads the certificate chain, the negotiated protocol, and the cipher. It then opens four short probe connections, one per protocol version, to learn which versions the server accepts. Nothing is sent to the application. Results are cached for five minutes.

Check	Points	Full credit
Trusted chain	25	Chain verifies against the public root store
Expiry	15	More than 30 days remaining
Hostname match	15	Hostname appears in the Subject Alternative Names
Key strength	10	RSA 2048 bits or more, or an elliptic curve key
Signature algorithm	10	SHA-256 or stronger
TLS 1.3	10	Accepted
TLS 1.2	5	Accepted
TLS 1.0 or 1.1	−15	Refused
Lifetime	−5	398 days or less

Grades: A+ at 95 or more, A at 85, B at 70, C at 55, D at 40, E at 20, F below 20. A certificate that browsers do not trust, for example an expired, self-signed, or mismatched certificate, caps the grade at F because visitors see a full-page warning.

Common failures and fixes

Expired certificate. Renewal automation failed or the cron job stopped. Renew now, then add expiry monitoring with a 30-day alert.
Incomplete chain. The server sends only the leaf certificate. Browsers with a cached intermediate work, others fail. Serve the full chain file from your certificate authority.
TLS 1.0 or 1.1 accepted. Legacy load balancers and appliances keep them on. Set the minimum version to TLS 1.2 in the server or the CDN.
Hostname mismatch. A shared hosting default certificate or a wildcard that does not cover a deeper subdomain. Add the name to the certificate or use a dedicated one.

What this tool does not do

It does not enumerate every cipher suite or test for specific vulnerabilities like Heartbleed or ROBOT.
It does not check ports other than 443 or protocols other than HTTPS.
It does not check revocation status beyond a stapled OCSP response.
It does not scan private, internal, or loopback addresses.

Pair this report with the security headers checker for HSTS and the subdomain finder to check every host, not just the main one.

Frequently asked questions

More free tools

Start testing in minutes

Connect your GitHub repos and domains, and get fully set up in a few clicks.

Start for free All free tools →