TLS Scanner: Deep Security Audit & Scan
Test which SSL/TLS protocols your server accepts, flag weak ones like SSLv3 (POODLE) and TLS 1.0, and get an A+ to F security grade for your server.
📖 Learn more: How to detect and fix SSL/TLS vulnerabilities
What the TLS Scanner Checks
The scanner connects to your server once for each protocol version, the same way different browsers and clients would, and records what the server accepts.
Protocol Support
- SSLv3: must be disabled. Accepting it exposes the server to the POODLE attack.
- TLS 1.0 and TLS 1.1: deprecated by RFC 8996 and rejected by modern browsers.
- TLS 1.2: the minimum version you should support.
- TLS 1.3: the fastest and most secure version.
Cipher and Certificate
- The cipher suite negotiated with the strongest supported protocol.
- Whether the certificate is valid and when it expires.
How to Run a TLS Scan
- Enter the hostname of the server you want to test, for example
example.com. - Leave the port as 443 for HTTPS, or enter another TLS port your service uses.
- Click Scan Server Security. The scanner attempts a separate handshake for each protocol version, so a scan takes a few seconds.
- Review the grade, the list of supported protocols, the negotiated cipher and any issues found.
How the Security Grade Is Calculated
- A+: TLS 1.3 is supported, no deprecated protocols are enabled and the certificate is valid.
- A: TLS 1.2 is the best protocol supported, with no deprecated protocols enabled.
- B: TLS 1.0 or TLS 1.1 is still enabled. Both were formally deprecated by RFC 8996 in 2021.
- C: No modern protocol could be negotiated.
- F: SSLv3 is enabled, which exposes the server to the POODLE attack, or the certificate is expired or invalid.
How to Improve a Low TLS Grade
Disable SSLv3, TLS 1.0 and TLS 1.1
On Nginx set ssl_protocols TLSv1.2 TLSv1.3;. On Apache set SSLProtocol -all +TLSv1.2 +TLSv1.3. On IIS, disable the old protocols in the registry or with a tool such as IIS Crypto, then restart the server.
Enable TLS 1.3
TLS 1.3 needs OpenSSL 1.1.1 or newer on Linux, or Windows Server 2022 and later. It removes legacy ciphers entirely and completes the handshake in one round trip, which also makes pages load faster.
Fix certificate problems first
An expired or invalid certificate fails the scan regardless of protocol settings. Check the certificate with the SSL Checker and renew or reinstall it before re-scanning.
Frequently Asked Questions
What does a TLS scanner do?
A TLS scanner connects to your server with each SSL/TLS protocol version to see which ones it accepts, records the cipher it negotiates, and checks the certificate. The results show whether outdated protocols are still enabled.
Why is my TLS security grade low?
The most common reasons are TLS 1.0 or TLS 1.1 still being enabled, which gives a B, or SSLv3 being enabled or the certificate being expired, which gives an F. Disable the old protocols and renew any invalid certificate, then scan again.
Does this scanner test for Heartbleed?
No. Heartbleed (CVE-2014-0160) is a bug in old OpenSSL versions rather than a protocol setting, and this scanner does not send exploit probes. Our guide to detecting and fixing SSL/TLS vulnerabilities explains how to check for it.
Is it safe to scan my production server?
Yes. The scanner only performs normal TLS handshakes, the same as a browser connecting with different protocol versions. It does not send attack traffic.
Do I need TLS 1.3 for an A grade?
No. TLS 1.2 with no deprecated protocols earns an A. Adding TLS 1.3 raises the grade to A+ and improves handshake speed.