SSL/TLS checker

Enter a domain to grade its HTTPS setup: certificate, TLS versions, key exchange and ciphers. Free, no sign-up.

What we check

We open real TLS handshakes to your server on port 443 (or 8443), one for each protocol version and cipher family, and read the certificate chain it sends.

Certificate trustValid chain to a trusted root, right host name, not expired.
Protocol versionsTLS 1.3 and 1.2 on; TLS 1.0 and 1.1 off.
Key strengthRSA 2048 bits or more, or an EC key like P-256.
Forward secrecyECDHE key exchange, so a stolen key cannot decrypt old traffic.
Cipher suitesAEAD ciphers preferred; CBC and weak DH groups flagged.
HSTSStrict-Transport-Security with a max-age of 180 days or more.

How the grade works

A+No issues, TLS 1.3, and HSTS for at least 180 days.
A / A-Solid. A- means TLS 1.3 is not enabled yet.
BTLS 1.0 or 1.1 still on, a small key or DH group, or an incomplete chain.
FNo TLS 1.2 or 1.3, or keys an attacker can break.
TBrowsers will not trust the certificate. We show what it would get once fixed.

A modern baseline

For nginx. Most CDNs and load balancers have the same switches.

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
ssl_stapling on;
ssl_certificate /etc/ssl/fullchain.pem;  # leaf + intermediates
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Strong TLS protects the pipe, not the app

An A+ means nobody can read or change traffic in transit. It says nothing about the injection, broken access control or leaky API on the other end. GhostProbe runs a full penetration test on your app and a person reviews every finding.

Run a pentest

What we check

We open real TLS handshakes to your server on port 443 (or 8443), one for each protocol version and cipher family, and read the certificate chain it sends.

Certificate trustValid chain to a trusted root, right host name, not expired.

Protocol versionsTLS 1.3 and 1.2 on; TLS 1.0 and 1.1 off.

Key strengthRSA 2048 bits or more, or an EC key like P-256.

Forward secrecyECDHE key exchange, so a stolen key cannot decrypt old traffic.

Cipher suitesAEAD ciphers preferred; CBC and weak DH groups flagged.

HSTSStrict-Transport-Security with a max-age of 180 days or more.

How the grade works

A+No issues, TLS 1.3, and HSTS for at least 180 days.
A / A-Solid. A- means TLS 1.3 is not enabled yet.
BTLS 1.0 or 1.1 still on, a small key or DH group, or an incomplete chain.
FNo TLS 1.2 or 1.3, or keys an attacker can break.
TBrowsers will not trust the certificate. We show what it would get once fixed.

A modern baseline

For nginx. Most CDNs and load balancers have the same switches.

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
ssl_stapling on;
ssl_certificate /etc/ssl/fullchain.pem;  # leaf + intermediates
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Strong TLS protects the pipe, not the app

Run a pentest