SSL/TLS vulnerabilities are rarely the result of a broken encryption algorithm. They're almost always configuration problems — an old protocol version left enabled, a weak cipher suite included for backward compatibility, or a missing security header. Each one is detectable and fixable without replacing your certificate. This guide shows you how to find every common vulnerability and what server config change removes it.
Detecting SSL/TLS Vulnerabilities on Windows
Windows Server
PowerShell
OpenSSL on Windows
The same OpenSSL commands from the Linux section work on Windows after installing OpenSSL:
:: Install OpenSSL via winget
winget install ShiningLight.OpenSSL
:: Then use OpenSSL exactly as in the Linux section above:
openssl s_client -connect yourdomain.com:443 2>nul
openssl s_client -connect yourdomain.com:443 -ssl3 2>nul :: Test SSLv3 (should fail)
openssl s_client -connect yourdomain.com:443 -tls1 2>nul :: Test TLS 1.0
Test-NetConnection (Built-in PowerShell)
# Quick connectivity check without OpenSSL
Test-NetConnection -ComputerName yourdomain.com -Port 443
# More detailed — using .NET to check TLS negotiation
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$req = [System.Net.WebRequest]::Create("https://yourdomain.com")
$res = $req.GetResponse()
Write-Host "TLS version: $($req.ServicePoint.SupportedProtocols)"
$res.Close()
Nmap SSL Vulnerability Scan on Windows
:: Install Nmap (includes ssl-enum-ciphers script)
winget install Insecure.Nmap
:: Scan for supported cipher suites and TLS versions
nmap --script ssl-enum-ciphers -p 443 yourdomain.com
:: Check for POODLE (SSLv3)
nmap --script ssl-poodle -p 443 yourdomain.com
:: Check for HEARTBLEED
nmap --script ssl-heartbleed -p 443 yourdomain.com
Fix Vulnerabilities on Windows (IIS)
After identifying weak protocols or ciphers, disable them via the Schannel registry:
# Disable weak cipher suites (run in elevated PowerShell)
$weakCiphers = @("RC4 128/128", "RC4 64/64", "RC4 56/56", "RC4 40/128",
"DES 56/56", "Triple DES 168", "NULL")
foreach ($cipher in $weakCiphers) {
$path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\$cipher"
New-Item -Path $path -Force | Out-Null
New-ItemProperty -Path $path -Name "Enabled" -Value 0 -PropertyType DWORD -Force | Out-Null
Write-Host "Disabled: $cipher"
}
# Reboot required after Schannel changes
IIS Crypto simplifies this: The free
IIS Crypto tool (nartac.com) provides a GUI for all Schannel protocol and cipher settings. Click "Best Practices" to disable known-weak ciphers in one step — much faster than editing registry keys manually.
Detecting SSL/TLS Vulnerabilities on macOS
macOS
Terminal
# macOS includes LibreSSL — OpenSSL-compatible commands work the same way
openssl s_client -connect yourdomain.com:443
# Install real OpenSSL for more features (LibreSSL lacks some options)
brew install openssl
/opt/homebrew/opt/openssl/bin/openssl s_client -connect yourdomain.com:443 -tls1
# Install Nmap for cipher and vulnerability scanning
brew install nmap
nmap --script ssl-enum-ciphers -p 443 yourdomain.com
nmap --script ssl-poodle,ssl-heartbleed -p 443 yourdomain.com
# Install testssl.sh — comprehensive TLS vulnerability scanner
brew install testssl
testssl.sh yourdomain.com
testssl.sh is the most comprehensive CLI TLS scanner available on macOS. It checks for POODLE, BEAST, BREACH, HEARTBLEED, ROBOT, LUCKY13, DROWN, Logjam, FREAK, and dozens of other vulnerabilities in a single run.