How it works
Once a day, we test how your server sets up encrypted connections:
- Handshake: we try each TLS version, from TLS 1.0 to TLS 1.3, and record which ones the server accepts.
- Chain: the certificate chain must be complete and trusted.
- Hostname: the certificate must match your host name.
- Legacy protocols: TLS 1.0 and 1.1 have known weaknesses. Every modern browser has dropped them, and standards such as PCI DSS forbid them.
The SSL certificate check reports chain and hostname problems as a single failure. This check tells them apart, and adds the protocol versions.
Statuses
| Status | Meaning |
|---|---|
| OK | The server accepts only modern TLS versions with a valid chain. |
| Warning | The server still accepts TLS 1.0 or 1.1. |
| Failed | No TLS handshake succeeded, the chain is incomplete or untrusted, or the certificate does not match the host name. |
By default you are notified of warnings and failures.
Fixing common problems
- Legacy TLS accepted: allow only TLS 1.2 and 1.3. In nginx, use
ssl_protocols TLSv1.2 TLSv1.3;. In Apache, useSSLProtocol -all +TLSv1.2 +TLSv1.3. On a CDN or load balancer, pick a modern TLS policy. - Incomplete chain: configure the full chain file instead of the certificate alone.