TLS configuration checker
HTTPS being green in the address bar says very little. This checks which protocol versions and ciphers your server is still willing to negotiate, whether the certificate chain actually validates, and how long you have before it expires.
Passive checks only — nothing is scanned, attacked, or stored.
What a padlock does and doesn't tell you
The padlock means the connection was encrypted and the certificate validated. It says nothing about how it was encrypted. A server that still accepts TLS 1.0 with a CBC cipher shows the same padlock as one that only speaks TLS 1.3.
That gap is the entire point of this check. The failure mode is not a broken padlock — it is a perfectly green one in front of a configuration that has not been touched since it was set up.
What to fix, in order
Enable TLS 1.3 first: it is the largest improvement for the least work. Then disable TLS 1.0 and 1.1, which no current browser will use anyway. Then check that certificate renewal is genuinely automated rather than a calendar reminder somebody left with the company.
Common questions
- Why does it matter that TLS 1.0 is still enabled if browsers won't use it?
- Browsers won't, but not everything that connects to you is a browser. Old API clients, embedded devices and scripts will happily negotiate whatever the server allows, and an attacker sitting between two parties can influence which version gets chosen. Leaving a deprecated version enabled buys you compatibility with clients you probably don't have, at the cost of a downgrade path you definitely don't want. Turning it off is a single configuration line.
- What does 'not testable' mean next to a version?
- It means this checker's own TLS library refused to attempt that version, so no handshake was sent and the server never got the chance to answer. Modern OpenSSL builds disable TLS 1.0 and 1.1 at their default security level. Reporting that as 'the server doesn't support it' would be a guess dressed up as a finding, so it says what actually happened instead.
- Should I care about TLS 1.3?
- Yes, and it is usually the easiest win here. It removes entire classes of problem by design — no renegotiation, no static RSA key exchange, a much smaller set of cipher suites with the weak ones simply absent — and it completes the handshake in fewer round trips, so it is also faster. On most modern stacks enabling it is a configuration change rather than a project.
- My certificate expires in two weeks and this says that's a problem. It renews automatically.
- Then it isn't a problem — but the flag is still worth having, because automated renewal is exactly the thing everyone believes is working right up until the morning it isn't. If you see this warning and you know renewal is automated, the useful reaction is to check when it last succeeded rather than to dismiss it.
- Does this connect to my server or attack it?
- It opens a TLS handshake on port 443 and reads what the server agrees to, then repeats that handshake pinned to each protocol version. No HTTP request is ever sent, so it cannot log in, cannot reach your application, and cannot trigger any behaviour beyond the handshake itself. In your logs it looks like a connection that opened and closed.
Related
TLS is one of three things a browser checks before it renders anything. The header checker covers the second, and the DNS hygiene check covers what happens before the connection is even made.