Question 1

What does the SSL checker test?

Accepted Answer

It opens TLS connections to port 443 and reads the certificate that the server presents. It checks the expiry date, the hostname match, the signature algorithm, the key size, and the chain. It then tests which protocol versions the server accepts, from TLS 1.0 to TLS 1.3.

Question 2

How is the SSL grade calculated?

Accepted Answer

A valid, trusted certificate with more than 30 days left earns the most points. TLS 1.3 support and a strong key earn more. Legacy protocols TLS 1.0 and TLS 1.1, weak signature algorithms, and short keys subtract points. An expired or mismatched certificate fails the check.

Question 3

Does the checker test cipher suites or known TLS vulnerabilities?

Accepted Answer

It tests protocol versions and reads the negotiated cipher for each. It does not run exploit probes for Heartbleed, ROBOT, or padding oracles. A Strix pentest covers those and the application behind the certificate.

Check	Points	Full credit
Trusted chain	25	Verifies against the public root store
Expiry	15	More than 30 days remaining
Hostname match	15	Hostname in the Subject Alternative Names
Key strength	10	RSA 2048 bits or more, or an elliptic curve
Signature algorithm	10	SHA-256 or stronger
TLS 1.3	10	Accepted
TLS 1.2	5	Accepted
TLS 1.0 or 1.1	−15	Refused
Lifetime	−5	398 days or less

SSL/TLS Checker

How it works

Frequently asked questions

Start testing in minutes