Free tool · Certificates · Protocols
Free SSL/TLS checker for your domain.
An expired certificate or an old TLS version is the kind of issue a buyer’s security team spots in minutes. Check yours before they do.
CertificateValidity, chain, issuer, hostname and expiry.
ProtocolsWhether TLS 1.0 or 1.1 is still accepted.
FreePart of the free Sumrite scan.
An SSL/TLS checker connects to your server and reports on the certificate (whether it is valid, trusted, matches the hostname and when it expires) and on the TLS protocol versions and settings the server accepts. Modern servers should accept only TLS 1.2 and TLS 1.3.
What the TLS check looks at
| Check | Why it matters | What good looks like |
|---|---|---|
| Certificate validity | Browsers block expired or untrusted certificates | Issued by a trusted CA and not expired |
| Hostname match | A mismatch triggers browser warnings | The certificate covers every hostname you serve |
| Chain | Missing intermediates break some clients | The full chain is served |
| Expiry window | Certificates that expire soon cause outages | Automated renewal well before expiry |
| Protocol versions | TLS 1.0 and 1.1 are deprecated and weak | Only TLS 1.2 and TLS 1.3 accepted |
| HSTS | Stops downgrade to HTTP | Strict-Transport-Security with a long max-age |
Frequently asked questions
What is the difference between SSL and TLS?
TLS is the modern successor to SSL. People still say “SSL certificate”, but every current secure connection uses TLS.
Which TLS versions should my server allow?
TLS 1.2 and TLS 1.3 only. TLS 1.0 and 1.1 are deprecated.
Does the check change anything on my server?
No. It makes normal connections, the way a browser does.
More free tools
Security headers checkDMARC and SPF checkerSubdomain finderAPK and IPA security scannerFree DPDP PII discovery
Need evidence for an audit, not just a check?
Sumrite’s VAPT report is mapped to SOC 2, ISO 27001, PCI DSS and more.