Free SSL/TLS Certificate & Cipher Suite Checker
Verify SSL/TLS certificate chains, audit protocol negotiations (TLS 1.0-1.3), flag legacy cipher suites, and prevent surprise certificate expiration outages.
Non-destructive handshake analysis on port 443. Authorized testing only.
$ wesecurex-tls --target example.com:443
[PASS] TLS 1.3: Enabled (TLS_AES_256_GCM_SHA384, 1-RTT Handshake)
[PASS] TLS 1.2: Enabled (ECDHE-ECDSA-AES256-GCM-SHA384)
[PASS] TLS 1.0 & 1.1: Disabled (Secure against BEAST/POODLE)
[PASS] Certificate Chain: Leaf -> Intermediate R3 -> ISRG Root X1 (Valid)
[PASS] Expiration: 78 days remaining (Monitored in Surface Recon)
[PASS] DNS CAA Record: '0 issue "letsencrypt.org"' verified
[RESULT] Overall Transport Grade: A+ (Zero Legacy Ciphers)
Configure Modern TLS 1.3
Read our complete technical guide to modern TLS 1.3 and cipher suite architecture.
How Often to Run Security Scans?
Recommended scan cadences for SSL certificate rotation, TLS handshakes, and perimeter health.
Upgrade from Single-Check to Automated DAST Vulnerability Scanner
Full-scale active fuzzing for OWASP Top 10, SQLi, XSS, SSRF & BOLA. Scale with automated schedules, Slack alerts, 150+ monthly credits, and compliance PDF exports on our paid tiers.
Frequently Asked Questions
Why are TLS 1.0 and TLS 1.1 considered insecure?
TLS 1.0 and 1.1 rely on outdated cryptographic hashing functions (MD5, SHA-1) and vulnerable cipher block chaining (CBC) modes susceptible to attacks like BEAST, POODLE, and Lucky 13. The IETF officially deprecated both protocols in RFC 8996.
What is Perfect Forward Secrecy (PFS)?
Perfect Forward Secrecy ensures that if a server's long-term private key is ever compromised in the future, past recorded encrypted sessions cannot be decrypted. Modern cipher suites use ephemeral Diffie-Hellman keys (ECDHE) to generate unique keys for every session.
What is DNS CAA and why should I configure it?
DNS CAA (Certificate Authority Authorization) is a DNS record that specifies which Certificate Authorities (like Let's Encrypt or DigiCert) are permitted to issue SSL certificates for your domain. It prevents unauthorized CAs from issuing fraudulent certificates if your DNS or account credentials are compromised.
What is OCSP Stapling?
OCSP Stapling allows the web server to query the Certificate Authority periodically and 'staple' a time-stamped proof of validity to the initial TLS handshake. This eliminates privacy leaks and latency from clients contacting the CA directly.