SSL/TLS test

This free SSL test inspects your website's complete HTTPS setup: the certificate and its chain of trust, validity dates and hostname match, key strength, the offered TLS versions (1.0 to 1.3) and cipher suites, Perfect Forward Secrecy, HSTS, revocation and Certificate Transparency, HTTP/2, HTTP/3 and the HTTP-to-HTTPS redirect. You get a single A+ to F grade with a clear explanation of every finding – a fast, free alternative to SSL Labs. Check your domain →

What the SSL certificate check verifies

The test opens a real TLS connection on port 443 and validates the certificate the way a browser would. It builds the chain against a combined, up-to-date root store (operating system, Node and the CCADB/Mozilla TLS roots) and rejects anything that is self-signed or issued by an unknown authority. It then checks the parts that make or break trust:

Chain of trust: the served chain must lead to a publicly trusted root; a missing intermediate is flagged separately from a genuinely untrusted certificate.
Hostname match: the requested name must appear in the certificate's Subject Alternative Names (SAN), per RFC 6125 – otherwise you get a mismatch grade.
Validity: an expired certificate is a hard error in every browser; the test warns 15 days before expiry.
Key strength and signature: RSA should be at least 2048 bits or ECDSA P-256; SHA-1 and MD5 signatures are rejected as forgeable.

Certificate structure follows the X.509 profile in RFC 5280, and lifetimes follow the CA/Browser Forum Baseline Requirements, which now cap leaf validity at 200 days for certificates issued from 15 March 2026.

TLS versions, cipher suites and forward secrecy

Only TLS 1.2 (RFC 5246) and TLS 1.3 (RFC 8446) are considered current. TLS 1.3 is faster (1-RTT), removes obsolete cryptography and always provides forward secrecy. TLS 1.0 and 1.1 rely on outdated primitives (SHA-1 in the handshake, CBC without AEAD), are exposed to the BEAST attack and are formally deprecated by RFC 8996; every major browser dropped them in 2020, so the test warns or fails when they are still enabled.

The test enumerates the offered cipher suites per TLS version and flags anything broken – RC4, 3DES, NULL, export and anonymous suites. It confirms that modern AEAD ciphers (AES-GCM, ChaCha20-Poly1305) are available and that key exchange uses Perfect Forward Secrecy via ECDHE or DHE, so a later key compromise cannot decrypt recorded traffic. A well-configured server passes with something like:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:...;
ssl_prefer_server_ciphers off;

HSTS, the HTTPS redirect and modern transport

A secure site should never start unencrypted. The test confirms that plain http:// requests are permanently redirected (301/302) to https://, and it checks the HSTS header (RFC 6797), which tells browsers to use HTTPS for a fixed max-age and to refuse fallback to HTTP. Together they close the window an attacker could use to strip TLS from the first request.

It also reports the transport quality around your certificate:

Revocation: the certificate must carry CRL and/or OCSP information; active OCSP stapling earns a small bonus.
Certificate Transparency: certificates issued since 2018 need valid SCTs so mis-issuance is publicly detectable.
HTTP/2 and HTTP/3: HTTP/2 is negotiated via ALPN h2; HTTP/3 runs over QUIC on UDP 443 and is advertised with Alt-Svc. These are performance signals, not penalties.

How the SSL grade is calculated

The scoring follows the SSL Labs Server Rating Guide, so results are directly comparable with the tools you may already know. Every finding has a weight, but the score is not a simple average: a single serious problem caps the grade regardless of everything else. An expired certificate or a broken cipher caps the module at F; a missing TLS 1.3 caps it at A-; an incomplete chain caps it at B.

Untrusted or invalid certificates receive special grades instead of a letter – T when the chain is not trusted and M when the hostname does not match – because those are trust failures, not quality gradations. This makes the result honest and easy to act on: fix the capping issue first, then work down the list. It is a free, no-signup SSL Labs alternative you can re-run as often as you like.

Frequently asked questions

What is the difference between SSL and TLS?

TLS is the modern successor of SSL. The old SSL 2.0 and 3.0 protocols are insecure and long disabled; today's encryption is TLS 1.2 and TLS 1.3. People still say SSL out of habit, but every current SSL test is really testing your TLS configuration and X.509 certificate.

Is this a free SSL Labs alternative?

Yes. The test uses the same SSL Labs Server Rating Guide, covers the certificate chain, TLS versions, cipher suites, forward secrecy, HSTS and the HTTP-to-HTTPS redirect, and gives you an A+ to F grade. It needs no account, runs in seconds and you can repeat it as often as you like.

Why did my certificate fail the hostname check?

A certificate is only valid for the names listed in its Subject Alternative Names field. If you request example.com but the SAN only contains www.example.com, there is no proof the certificate belongs to that exact host, so the test reports a mismatch. Reissue the certificate with every name you serve, including the www variant if you use it.

Sources

RFC 8446 (TLS 1.3) ↗ · RFC 5246 (TLS 1.2) ↗ · RFC 5280 (X.509) ↗ · RFC 6797 (HSTS) ↗ · SSL Labs Rating Guide ↗ · CA/Browser Forum Baseline Requirements ↗