SSL/TLS Checker

TLS 1.3 (2018) is significantly faster and more secure than TLS 1.2. It removes legacy cipher suites, reduces the handshake from two round trips to one, and mandates forward secrecy on every connection. Most modern browsers and servers support TLS 1.3 — there is almost no reason to keep TLS 1.2 as your only option, but it remains a safe fallback.

TLS 1.0 and 1.1 are vulnerable to known attacks including POODLE and BEAST, use deprecated cipher suites, and have been formally deprecated by the IETF (RFC 8996, March 2021). PCI DSS 3.2+ requires TLS 1.0 to be disabled. All major browsers removed support in 2020. If your server still accepts TLS 1.0 or 1.1, disable them in your web server configuration.

Forward secrecy (or Perfect Forward Secrecy) means each TLS session uses a unique, ephemeral key. If an attacker records encrypted traffic today and later obtains your server's private key, they still cannot decrypt past sessions. Cipher suites using ECDHE or DHE key exchange provide forward secrecy. Without it, a future private-key compromise exposes all previously recorded sessions.

The Domain & SSL Health Check covers certificate basics (issuer, expiry, hostname match) alongside DNS records and mail blacklists — a broad domain health snapshot. This SSL/TLS Checker goes deeper on the TLS configuration itself: it enumerates which protocol versions your server accepts, reports the negotiated cipher and whether it provides forward secrecy, checks HSTS, and grades the overall TLS posture. Use both for a complete picture.