Tools / TLS / SSL checker

TLS / SSL checker

Completes a TLS handshake, parses the certificate it gets back, probes which protocol versions the server still accepts, checks HSTS, and grades the result.

What it checks

Certificate — subject, all SANs, issuer, validity window, days remaining, serial.
Validation — hostname match against CN/SAN, self-signed, chain length, expiry.
Key & signature — RSA/EC key size, signature algorithm (flags SHA-1 / MD5).
Protocol support — a separate handshake for SSLv3, TLS 1.0, 1.1, 1.2 and 1.3; legacy versions are flagged.
HSTS — whether Strict-Transport-Security is set.

Grade

Starts at A+ and is capped down for: expired or not-yet-valid (F), hostname mismatch (F), SHA-1/MD5 signature (F), SSLv3 enabled (F), RSA < 2048 (C), TLS 1.0/1.1 enabled (B), no TLS 1.2+/no HSTS, and certificates expiring soon.

Notes

Pure handshake probe. Cipher-suite enumeration and BEAST / POODLE / Heartbleed active tests are out of scope here — that needs testssl.sh. Ask us for a full TLS review.