SSL Security Test

Review your server's TLS protocols, certificate chain, cipher evidence, and security headers in one report.

Our letter grade summarizes the checks shown below. A separate targeted test checks whether the server selects 3DES, even when the standard OpenSSL cipher list cannot offer it.

Scanning

Initializing...

What does this SSL security test check?

This tool tests TLS protocol versions, accepted suites offered by its OpenSSL build, certificate-chain health, and HTTP security headers. A separate targeted 3DES offer checks for a legacy suite that the standard cipher list may miss. The report shows the evidence behind SecurityAlert's A+ through F grade.

What we check

Every scan touches the same eight areas, in roughly the order an attacker would probe them.

Protocol support. SSL 2.0 and SSL 3.0 are tested and flagged as failed if accepted. TLS 1.0 and TLS 1.1 are deprecated and downgrade the grade. TLS 1.2 with modern ciphers is the floor for a clean report. TLS 1.3 is preferred.
Cipher suites. The standard scan tests suites available to its OpenSSL build; it is not an exhaustive list of everything the server accepts. A separate 3DES-only ClientHello records whether the server selects that legacy cipher. AEAD suites are preferred; weak suites lower the grade.
Key exchange. ECDHE is preferred for forward secrecy. Plain RSA key transport is flagged because past traffic becomes decryptable if the private key is later compromised. Anonymous Diffie-Hellman fails the scan.
Forward secrecy. We list which suites support FS and whether forward secrecy holds across all suites the server will negotiate, not just the preferred one.
Certificate chain. Trust anchor verification, expiry window, hostname match against subject CN and SAN list, completeness of intermediates, and signature algorithm strength.
Vulnerability tests. BEAST, POODLE, FREAK, LOGJAM, CRIME, and BREACH. Each is checked against the negotiated parameters, not just the protocol version.
HTTP security headers. HSTS (and whether preload and includeSubDomains are set), Content Security Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.
DNS surface. CAA records and DNSSEC status, because a perfect TLS config is undermined if anyone can issue a cert for the domain.

Grading methodology

Our scoring draws on SSL Labs-style categories but is an independent assessment, so grades from the two tools need not match. The overall score combines Protocol Support (30%), Key Exchange (30%), and Cipher Strength (40%), then applies caps for specific findings.

TLS 1.0 supported: grade capped at B.
SSL 3.0 or older supported: grade capped at C.
Expired or untrusted certificate: grade is F regardless of other scores.
A weak suite accepted by the standard scan, or 3DES selected by the targeted ServerHello check: grade capped at C. The targeted result is shown separately because it does not complete a full handshake.
A+ requires HSTS with preload, or a strong CSP. Without one of those, the highest achievable grade is A.

The grade is the headline number, but the per-category subscores are usually more actionable. A site at an A grade with a 70% protocol score and a 95% cipher score is one TLS 1.3 rollout away from A+.

When to use this

A few situations where a one-off scan earns its keep.

Pre-deployment. Before you point a new domain at the public internet, run a scan against the staging hostname. It is much cheaper to fix a missing intermediate now than during the launch window.
Auditor pre-meeting. If an external auditor is about to look at your TLS posture, look first. Save the report URL, fix what is fixable, and walk in knowing the worst they can find.
Compliance evidence. SOC 2, ISO 27001, and PCI DSS 4.0 all require strong transport encryption with documented evidence. The shareable report URL is the evidence, dated and re-runnable on demand.
Vendor due diligence. Scanning a SaaS provider's login domain before signing a contract is a five-second check that occasionally surfaces real problems.

For ongoing tracking rather than point-in-time checks, continuous TLS monitoring is part of the paid SecurityAlert plan. It re-scans on a schedule, alerts on grade drops, certificate changes, and upcoming expiry, and stores the history so you can show a trend line in board reports.

Frequently asked questions

How is this different from SSL Labs?

SecurityAlert uses its own letter grade and selected SSL Labs-style scoring concepts. Our OpenSSL cipher list can omit suites the scanner cannot offer, so we run a separate targeted 3DES check. Compare the underlying evidence, not just the letter grade.

Why does my A grade drop on the second scan?

A few common reasons. Your HSTS header was removed or its max-age was lowered. Your hosting provider rotated cipher suites and a weaker one is now being negotiated. The certificate was reissued and the new chain is incomplete. A CDN or load balancer changed the TLS profile. Compare the two reports side by side to spot which subscore moved.

What does "grade capped" mean?

Some configurations force a maximum grade no matter how strong the rest of the setup is. Supporting TLS 1.0 caps the grade at B. An expired certificate forces F. A weak cipher in the accepted list caps the grade at C. To reach A+ you need HSTS with preload, or a strong CSP. Otherwise you are capped at A.

Do you store my scan results?

Yes. Public scans are cached for 30 days so report URLs stay shareable and SEO crawlers can index them. The cached report includes the domain, grade, scores, certificate metadata, protocol and cipher list, and header findings. Nothing private is captured because everything we test is already publicly visible on port 443.

Can I scan internal hosts?

No. This free tool only scans public-internet hosts. Internal certificate inventory and continuous internal-host scanning are part of the paid SecurityAlert plan, which runs from inside your network.

Is the grade equivalent to SSL Labs?

No. The tools use different test coverage and may assign different grades. Review SecurityAlert's protocol, certificate, cipher, and targeted 3DES evidence when interpreting our result.

Looking for continuous monitoring? SecurityAlert tracks your certificates and grades automatically and alerts you before expiry, as part of a paid plan.