SSL Checker

About the ssl checker

This tool connects to a host over HTTPS, retrieves the certificate chain it presents, and checks each link: whether the leaf certificate matches the hostname, whether it is currently within its validity window, and whether the chain leads to a root trusted by common browsers. A broken chain, where an intermediate certificate is missing, is a frequent cause of failures on some clients even when the certificate itself is fine.

It also negotiates and reports the TLS protocol versions and cipher suites the server supports. TLS 1.2 and 1.3 are current — TLS 1.3 was republished as RFC 9846 in July 2026, obsoleting RFC 8446 — while TLS 1.0 and 1.1 are formally deprecated by RFC 8996 and should be disabled, since they carry known weaknesses and have failed PCI DSS since June 2018. Forward secrecy, where each session uses a key that cannot later be derived even if the server's long-term private key is compromised, is checked separately from the protocol version, since an otherwise modern configuration can still offer static-RSA key exchange and lose the property entirely.

The overall grade weighs certificate validity, protocol and cipher configuration, and the presence of HSTS, which tells browsers to only ever connect to the host over HTTPS, closing the small window during a plain-HTTP-to-HTTPS redirect where a connection could otherwise be intercepted. The top grade requires TLS 1.3 to be offered, as an affirmative result rather than an absence of faults — and a scan that could not test protocols, because the TLS probe was unreachable, does not satisfy it either. We would rather tell you the check did not run than award a grade on the strength of nothing.

A high grade is not a one-time achievement, since certificates expire and cipher recommendations shift. If you use an ACME client, it should renew at roughly a third of the certificate's remaining lifetime — thirty days out on a ninety-day certificate — so a certificate inside thirty days of expiry usually means automation stopped running rather than that renewal is merely due.

Common questions

What grade is good?

A or A+ means TLS 1.2 and 1.3 only, forward-secret cipher suites, a complete and valid chain, and HSTS enabled. TLS 1.3 has to be positively observed for the top grade; a protocol check that could not run does not count in your favour.

Is the chain order important?

It should be leaf first, then intermediates, and the root should not be sent at all. Out-of-order chains are tolerated by TLS 1.3 clients, so we treat that as a minor issue, whereas a genuinely missing intermediate breaks trust on clients that cannot fetch it themselves.

My certificate expires soon, what do I do?

Renew it before the expiry date. If you use Let's Encrypt, the auto-renewal has likely failed silently; check the ACME client's logs for the actual error.

Is TLS 1.0 really dangerous?

It is formally deprecated by RFC 8996, fails PCI DSS compliance, and has known cryptographic weaknesses. It should be disabled on any server that still offers it.

What does a missing intermediate certificate cause?

Some clients will fail to build a trusted chain even though the leaf certificate itself is valid, because they cannot connect it to a trusted root without the intermediate the server should have sent.