SSL/TLS Server Test

It connects to a server the way a browser or mail client would and reports how well the server's encrypted connections are set up: which protocol versions and cipher suites it accepts, whether its certificate is valid and trusted, and which known weaknesses apply.

The result is summed up in one grade from A+ to F, with every point that lowered it listed below.

• Enter a host name, such as example.com. IP addresses cannot be tested.
• Choose the port: 443 for websites, or a mail, directory or DNS over TLS port, including the mail ports that switch to TLS with STARTTLS.
• Click Start Test. Each step shows as it runs; a test takes between a few seconds and a minute.
• A link such as /check/ssl/example.com starts the test when it is opened.
• Use Stop to end a running test.
• Only test servers you run or are allowed to test. The checks for known bugs send deliberately malformed messages, which an intrusion detection system may report.

• Besides what a normal handshake shows, the test probes for Heartbleed, OpenSSL CCS injection, Ticketbleed, ROBOT, the CBC padding oracles and client-initiated renegotiation, and asks the OCSP responder whether the certificate has been revoked.
• Servers are reached over IPv4. When a name has several addresses, the first one is tested, and each of the others can be tested from the result.
• A result is kept for an hour. Testing the same host and port again within that time shows the kept result.
• Up to five tests per visitor in ten minutes.