Vanorika Technologies

Free tool

TLS / Protocol Checker

Find out which TLS versions your site accepts, and whether it still allows weak, legacy protocols attackers exploit.

Passive. We attempt a handshake at each protocol version. No data is sent beyond the standard TLS negotiation.

What this checks

  • Attempts four separate connections, each locked to one protocol version: TLS 1.0, TLS 1.1, TLS 1.2 and TLS 1.3.
  • Records which versions your server accepts and which it refuses.
  • Shows the cipher suite negotiated for each version that connected.
  • Flags TLS 1.0 and 1.1 as weak, and reports whether TLS 1.3 is available.

Why it matters

TLS 1.0 and 1.1 were formally deprecated by the IETF in RFC 8996 in 2021, and current browsers no longer use them. A server that still accepts them gives an attacker a weaker protocol to aim for and will be marked down by payment providers and compliance reviews. If you take card or mobile money payments, handle patient records or run a student portal, the protocol settings are part of how that data is protected in transit.

How to read the result

  • The ideal result is TLS 1.2 and TLS 1.3 accepted, with 1.0 and 1.1 refused.
  • If 1.0 or 1.1 shows as accepted, the server or load balancer still has legacy protocols switched on, which is a configuration change rather than a new certificate.
  • No TLS 1.3 is not a failure, but it usually means older server software. Upgrading brings faster connections as well as stronger defaults.
  • The cipher shown is what was agreed for that one connection. Names containing GCM or CHACHA20 are modern authenticated ciphers.

How to fix what it finds

  • On Nginx, set ssl_protocols TLSv1.2 TLSv1.3; and reload the service.
  • On Apache, set SSLProtocol -all +TLSv1.2 +TLSv1.3 in the SSL configuration.
  • If you sit behind Cloudflare or another CDN, set the minimum TLS version to 1.2 in its dashboard; the origin server should match.
  • On shared hosting where you cannot edit the server, ask your host to disable TLS 1.0 and 1.1 and to enable TLS 1.3.

Want it fixed for you, or tested properly? See what a test would cost or book a free 30 minute call.

Questions people ask

Should I disable TLS 1.0 and 1.1?

Yes. Both are deprecated, and all current mainstream browsers and operating systems support TLS 1.2. Only very old devices that cannot be updated would lose access.

What is the difference between SSL and TLS?

TLS is the successor to SSL, and every SSL version is now considered broken. People still say SSL certificate out of habit, but the connection itself uses TLS.

Does TLS 1.3 need a new certificate?

No. The same certificate works with TLS 1.2 and 1.3. Enabling 1.3 is a server software and configuration change.

Guides for what it finds

Related free tools