🔐 TLS / Cipher Analyzer
Negotiate TLS with a host and show the negotiated version, cipher suite, support for TLS 1.0–1.3, and certificate.
100% Free
No signup
Server-side
No logs / DB
Rate-limited
5 languages
Dark mode
📖 What this check tells you
During a TLS handshake the client offers a list of cipher suites and the server picks one. This check connects for real and enumerates the protocol versions and suites the server will accept. A valid certificate does not make the connection safe if the negotiated cipher is weak — the padlock says nothing about cipher strength, which is why this needs checking separately.
| Item | What it means | How to fix it |
|---|---|---|
| TLS 1.0 / 1.1 enabled | The major browsers dropped support in 2020 and PCI DSS forbids them. Leaving them enabled keeps a downgrade attack on the table. | On nginx use ssl_protocols TLSv1.2 TLSv1.3;; on Apache, SSLProtocol -all +TLSv1.2 +TLSv1.3. Before cutting them, check the User-Agents in your access log to see whether old clients actually reach you. |
| Key exchange without forward secrecy | With RSA key exchange, a future leak of the server key lets an attacker decrypt traffic they recorded in the past. ECDHE derives a throwaway key per session, so that retrospective break is not possible. | Restrict the suite list to ECDHE. List them as ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:... and set ssl_prefer_server_ciphers off; — deferring to the client's ordering is the current advice. |
| CBC mode, RC4, 3DES | All have known attacks: BEAST and Lucky13 against CBC, statistical bias in RC4, Sweet32 against 3DES. Modern configurations use only AEAD suites — AES-GCM or ChaCha20-Poly1305. | Rather than hand-rolling the list, paste the Intermediate profile from Mozilla's SSL Configuration Generator. Pick your server version and it emits a combination that is safe as of that moment. |
If a CDN or load balancer sits in front, that edge is what the browser actually negotiates with. Hardening the origin nginx achieves nothing while the edge runs an old configuration, so run this against the public FQDN.