SSL/TLS Checker
Certificate validity, expiry, and negotiated TLS protocol version.
This is one independent signal used by the Domain Security Score, and can also be run on its own for any domain.
Based on: RFC 8446 — The Transport Layer Security (TLS) Protocol Version 1.3 · RFC 5246 — The Transport Layer Security (TLS) Protocol Version 1.2 +1 more
About this validation
Inspects certificate validity, expiry, hostname match, protocol support, and key strength -- a valid certificate alone does not produce PASS if a serious TLS configuration problem exists.
- Protocol / standard:
- Rules reviewed:
- Sep 8, 2026
SEOTechTests methodology: Data source: a live TLS handshake and certificate inspection performed by SEOTechTests (SEOTechTests' own methodology, not a reproduction of any third-party grading algorithm). FAIL on an expired/untrusted/hostname-mismatched certificate, a deprecated protocol (TLS 1.0/1.1) still being accepted, neither TLS 1.2 nor 1.3 confirmed, or a sub-2048-bit RSA key; WARNING for a near-expiry certificate or a missing hardening feature (no forward secrecy); INFO-only for optional extras (OCSP stapling, ALPN/HTTP2). Standards: RFC 8446 (TLS 1.3) and RFC 5246 (TLS 1.2) define the protocols probed; RFC 5280 defines the X.509 certificate fields read. The richer /ssl-labs-checker page presents this exact same signal with a full breakdown rather than scoring it a second time.
Standards and vendor-documented behavior can change. This reflects the source as last reviewed above, not a permanent guarantee.
FAQ
What does the SSL/TLS Checker test?
It performs a live TLS handshake against the domain and inspects certificate validity/expiry/hostname match, which protocol versions are accepted, and basic key strength -- not just the certificate alone.
Why does an expired or soon-to-expire certificate matter?
An expired certificate causes browsers to show a hard security warning to every visitor, effectively breaking access to the site over HTTPS until it's renewed.
Is an older negotiated TLS version automatically a failure?
If the server still ACCEPTS a deprecated protocol (TLS 1.0/1.1) at all, that's flagged as a failure regardless of what it negotiates by default with a modern client -- a downgrade to the weaker version is still possible for an older or malicious client.
Does a valid certificate mean the site is fully secure?
No. A certificate can be perfectly valid while the server still accepts obsolete protocols or weak keys -- this check fails on those conditions specifically so a valid certificate alone can't produce a false PASS.