Transport Security
Is your HTTPS actually configured properly?
A padlock in the address bar only means the certificate validated. It says nothing about an expiring cert, a weak key, a SHA-1 signature, or TLS 1.0 still being accepted. This opens a real handshake and reports what your server actually negotiates.
- We open genuine TLS connections to port 443 — one per protocol version tested. This is a read-only handshake; nothing is sent to the application behind it.
- If our own OpenSSL build refuses to attempt a legacy version, we report it as untested rather than as disabled. Reporting an untested protocol as secure would be worse than not testing it at all.
- SNI is sent, so shared-hosting and CDN setups return the correct certificate.
- Only public domains are accepted. Internal hostnames and IP addresses are rejected so the tool cannot be used to probe private networks.
- Cipher-suite enumeration and vulnerability testing (Heartbleed, ROBOT, etc.) are out of scope here — those need an active test we won't run against someone else's server.
Need this checked across every host you own?
We audit TLS estates continuously — expiry monitoring, cipher policy and protocol hardening across every domain and subdomain.