TLS Config Checker

TLS has gone through several major versions, and a server's default configuration matters more than most teams realize: TLS 1.0 and 1.1 were formally deprecated by all major browsers years ago and fail PCI-DSS compliance outright, yet plenty of servers still accept them because nobody ever revisited the config after it was first set up. This checker connects like an ordinary client and reports whichever protocol version the server actually chose — its real-world default, not a theoretical list of everything it might accept.

The second half of this check is HSTS — the Strict-Transport-Security response header. Without it, a browser that has never visited your domain before will happily make its very first request over plain HTTP, and only get redirected to HTTPS after that first (unencrypted, interceptable) round trip. HSTS tells the browser "never try plain HTTP for this domain again, for the next N seconds" — closing that narrow but real window. It costs nothing to add and most web servers support it with a single configuration line.

A max-age below about a year suggests the header was added as an afterthought rather than a deliberate policy — the browsers that matter (Chrome's HSTS preload list, for instance) expect a substantial max-age before they'll consider a domain for preloading, which removes even that first-request window entirely.

None of this requires certificate changes — it's server/load-balancer configuration, usually a few lines, and it's the kind of thing that's easy to get right once and then forget to check again as infrastructure changes.

Want the full picture? Run the complete certificate health check