New
SSL Server Test
See how well your site's HTTPS is set up. Every server behind your domain gets an A+ to F grade, with the certificate, TLS versions, cipher suites and HSTS checked. Save the report as an image for security reviews.
What the test checks
- Every IPv4 and IPv6 address your domain points to, each tested on its own
- The certificate: trust, name, expiry, key, signature, chain, revocation and Certificate Transparency
- SSL 2.0, SSL 3.0 and TLS 1.0 to 1.3
- Every cipher suite the server accepts, in the order it prefers them
- Key exchange groups, including post-quantum X25519MLKEM768
- Forward secrecy, secure renegotiation, downgrade protection, compression and session resumption
- HSTS, the HTTP to HTTPS redirect and CAA records
How the grade works
- Score: protocol support counts 30%, key exchange 30% and cipher strength 40%. 80 or more is an A, 65 a B, 50 a C, 35 a D, 20 an E.
- F: untrusted, expired, revoked or wrong-name certificate, SSL 2.0, export, NULL or anonymous suites, or DH under 1024 bits.
- C at most: SSL 3.0, RC4, 3DES, TLS compression, no secure renegotiation, or no TLS 1.2.
- B at most: TLS 1.0 or 1.1, no forward secrecy for modern browsers, no AEAD suites, an incomplete chain, or keys or DH under 2048 bits.
- A- at most: no TLS 1.3, or no downgrade protection.
- A+: a clean A plus HSTS with a max-age of 180 days or more.
Only need expiry and issuer? Use the SSL Certificate Checker.