Discuss your project

TOOLBOX · SECURITY CHECK

Check SSL/TLS.

Is your certificate valid, the chain complete and TLS 1.0 really disabled? Enter a domain, get a grade and see which setting is missing.

The bot check protects the toolbox against automated abuse.

We open at most eight short TLS connections to port 443, read the certificate, protocol and encryption and disconnect right away. No page is fetched. We do not store results permanently.

WHAT IS CHECKED

Three Layers.
One Grade.

That a website is encrypted does not yet say how well. The certificate, protocol version and ciphers decide that. We check each layer separately.

  • 01

    Certificate

    Issued by a recognized authority, matching the domain, with a complete chain and sufficient remaining validity. Plus key, signature, serial number and SHA-256 fingerprint.

  • 02

    Protocols

    TLS 1.3 and 1.2 should work, TLS 1.1 and 1.0 should not. We request each version separately and lower the security level of our test client especially for the old ones.

  • 03

    Encryption

    Forward secrecy, authenticated encryption (AEAD) and whether the server still accepts old ciphers such as RSA key transport or CBC with SHA-1 on request.

HOW WE RATE

Clear Rules.
Documented Sources.

The grade follows published recommendations, not our taste. Every finding says what to do, usually with the matching line for nginx or Apache.

  • The benchmarks are BSI TR-02102-2 and the “intermediate” configuration of TLSRef (formerly Mozilla).
  • Critical, grade C at best: certificate not trusted, wrong name, expired or valid for only a few more days.
  • Clear deduction: TLS 1.0 or 1.1 accepted, missing intermediate certificate, no forward secrecy.
  • Warning: no TLS 1.3, remaining validity under 30 days, CBC ciphers, RSA key transport on request.
  • No effect on the grade: OCSP stapling and HTTP/2.
  • Whether the browser should only load the page over HTTPS (HSTS) is tested by the security header check.

Sources: BSI TR-02102-2, version 2026-01, TLSRef Server Side TLS, guidelines 6.0 (formerly Mozilla), TLSRef Configurator (formerly Mozilla SSL Configuration Generator), RFC 8446 (TLS 1.3) and RFC 8996 (deprecation of TLS 1.0 and 1.1).

STAY ON TOP OF IT

Check Once.
Know Continuously.

Certificates expire, and updates can change configurations. If you do not want to keep an eye on this yourself, we support you.

QUESTIONS

Good to Know.

What does the SSL/TLS check test?

It opens at most eight short TLS connections to port 443 of your domain, like a browser, and disconnects right after the handshake. It checks the certificate (trust, name, chain, remaining validity, key, signature), which TLS versions the server accepts and which encryption it negotiates. No page is fetched.

Why should TLS 1.0 and 1.1 be disabled?

The IETF deprecated both versions in 2021 with RFC 8996: they must no longer be negotiated because they lack current cryptographic algorithms. The technical guideline BSI TR-02102-2 no longer recommends them either. TLS 1.3, preferably, and TLS 1.2 are recommended.

Which rules is the rating based on?

The benchmarks are the technical guideline BSI TR-02102-2 (version 2026-01) and the “intermediate” configuration of the Server Side TLS guidelines (version 6.0), formerly published by Mozilla and now maintained by the TLSRef community working group. Every check has a weight: passed counts in full, a warning counts half. An untrusted, expired or wrongly named certificate limits the grade to C at best. We show OCSP stapling and HTTP/2, but they do not count.

My certificate is valid. Why are there still warnings?

A valid certificate is only one part. If the server also accepts old protocols or ciphers without forward secrecy, connections with clients that offer them are less protected. In TLS 1.3, RFC 8446 removed key exchange without forward secrecy altogether. We also show a short remaining validity as a warning: if the automatic renewal does not work, visitors will soon see a warning.

Does TOMORIS store my input or the result?

No, not permanently. The result stays in memory for five minutes so that repeated requests for the same domain do not put load on the server again. After that it is gone.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result