SSL Checker — HTTPS & TLS Security Test

This free SSL checker connects to a server the way a browser does and reports how its HTTPS is set up: which TLS versions it accepts (SSLv3 and TLS 1.0 to 1.3) and the cipher suite it negotiates for each, the certificate and certificate chain it presents, whether the certificate matches the domain and when it expires, whether HTTP/2 and OCSP stapling are enabled, and whether the site sends an HSTS header. It then gives a grade and a list of concrete fixes. Use it after deploying or renewing a certificate, before turning off old protocols, or when a browser shows a certificate warning.

How it works

1. Enter a domain name and, if the service is not on 443, its port (8443, 465, 636, 853, 993 or 995), then click Check SSL. You can also share a link such as https://justtoptools.com/ssl-check?host=example.com&port=443; opening it runs the check.
2. Our edge sends one TLS hello for each protocol version and reads the server's reply. A version counts as supported only when the server actually picks it; a refusal with a protocol_version alert, or a fall-back to an older version, counts as not supported. Any other failure is shown as Not determined rather than guessed.
3. From the TLS 1.2 handshake we read the raw certificate chain, the OCSP stapling status and the ALPN result for HTTP/2. A separate request reads the Strict-Transport-Security header.
4. Your browser decodes the certificates locally and calculates the grade. Example: a site with TLS 1.2 and 1.3, a valid certificate and HSTS scores A or A+; leaving TLS 1.1 enabled costs 10 points.

How the grade is calculated

Every check starts at 100 points. An expired certificate, a certificate that does not cover the domain, or a single self-signed certificate is an automatic F. The certificate expiring within 30 days costs 10 points (20 within 7 days); SSLv3 costs 30; TLS 1.0 and TLS 1.1 cost 10 each; missing TLS 1.3 costs 5; a SHA-1 signature or an RSA key under 2048 bits costs 20 each; a missing HSTS header costs 5. A+ needs at least 95 points and HSTS with a max-age of one year or more. Versions that could not be determined are not counted either way, and the grade is marked Partial.

Frequently asked questions

Why can't you test sites behind Cloudflare?

Our checker runs on Cloudflare's network, and Cloudflare does not allow its edge to open raw TCP connections to Cloudflare's own addresses. For those sites we show the HSTS result and the resolved addresses, but not the certificate or TLS versions, and we don't give a grade.

Why is the certificate missing for some servers?

We read the certificate from a TLS 1.2 handshake, where it is sent in plain text. In TLS 1.3 the certificate is encrypted, so for servers that only accept TLS 1.3 — or when the TLS 1.2 handshake could not be completed — the certificate is not available and the grade is partial.

Do you check certificate revocation or trust?

No. The tool reports whether the server staples an OCSP response, but it does not query OCSP or CRLs, and it does not validate the chain against a browser's root store. It also does not test for specific vulnerabilities or list every cipher suite the server accepts.

Do you store the domains I check?

No. A successful result is cached at our edge for five minutes so repeated checks don't hit the target again; nothing is stored beyond that and we don't log who ran a check.

Privacy

This is a server-side lookup. The domain and port you enter are sent to our site backend (a Cloudflare Pages Function), which connects to that server to run the checks. We don't create accounts or record who ran a check; a successful result is cached at the edge for five minutes. The certificate is decoded in your browser.