SSL/TLS Checker

Inspect a server's TLS setup from a single handshake: certificate and chain details, hostname and expiry checks, key strength, SCT, OCSP stapling, ALPN/HTTP/3 and an A–F grade with the rules shown openly.

Check

Host

Port Default 443. Allowed ports: 443, 465, 993, 995, 8443.

Deep scan Probes supported TLS versions and cipher suites, OCSP stapling and CAA records.

Result

Enter a host and click Check

What is checked

Certificate & chain: subject, issuer, validity dates, key type/size, self-signed status and the order of every certificate sent by the server.
Incomplete chain: detected from authorizationError (for example unable to get local issuer certificate). Missing intermediates are never downloaded via AIA because that would add an SSRF surface.
Extra root / order: a root sent by the server is reported as an informational note, not a warning; each certificate must still be issued by the next one in the chain.
Hostname: tls.checkServerIdentity() compares the requested host with CN/SAN; a mismatch lists all SAN entries.
Expiry: warning below 30 days, error below 14 days and failure once expired. For trusted chains, validity longer than the current CA/B Forum limit is flagged: 398 days before 2026-03-15, 200 days from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15. Private or otherwise untrusted CAs are not bound by this limit, so no warning is shown for them.
Key strength: RSA below 2048 bits and deprecated elliptic curves (P-192/P-224 and binary curves) are errors.
OCSP: “not stapled” is a warning only when the certificate contains an OCSP URL in infoAccess. Let’s Encrypt removed OCSP URLs in May 2025 and shut the service down in August 2025, so absence of a URL is not treated as a problem.
Certificate Transparency: the raw certificate is searched for the embedded SCT OID 1.3.6.1.4.1.11129.2.4.2. A missing SCT only reduces the score; it never caps the grade, because private corporate CAs usually do not publish to CT logs.
ALPN / HTTP/3: the handshake offers h2 and http/1.1; Alt-Svc from the HTTP response (over the same TLS socket) shows whether HTTP/3 is advertised.
CAA records: which certificate authorities are allowed to issue for the domain (RFC 8659).

The TLS handshake is performed by our server so the connection only ever goes to the resolved public IP of the host you entered. Legacy protocols and ciphers that our own OpenSSL refuses to offer are reported as “not verifiable” rather than “rejected”.

TLS grade rules

This is OrbitNet’s own A–F scale. The score is a weighted average of the checks below; caps are applied afterwards so a serious problem cannot be hidden by good marks elsewhere.

Rule	Weight	Effect
Trusted chain	25	Failure when the chain is untrusted or incomplete.
Hostname match	20	Failure when the certificate does not cover the host.
Validity period	20	Warning below 30 days, failure below 14 days or expired; for trusted chains, warning when longer than the CA/B limit.
Chain structure	10	Incomplete chain fails; extra root is informational; wrong order warns.
Public key strength	15	RSA below 2048 bits or a deprecated curve fails.
Certificate Transparency	5	No embedded SCT warns but does not cap the grade.
OCSP stapling	5	Only evaluated when an OCSP URL exists; a missing staple then warns.
ALPN	5	h2 passes; HTTP/1.1 or no negotiation warns without capping the grade.
HTTP/3 advertisement	3	An Alt-Svc h3 entry passes; otherwise warns without capping the grade.
TLS versions (deep)	15	TLS 1.0/1.1 fails; missing TLS 1.3 warns.
Cipher suites (deep)	10	A weak suite fails; legacy suites warn.
Ceiling F	—	Expired, hostname mismatch, untrusted/incomplete chain or weak key.
Ceiling C	—	TLS 1.0/1.1 or a weak cipher suite is accepted.
Ceiling B	—	A trusted certificate with excessive validity or an incorrectly ordered chain.

A ≥ 90, B ≥ 80, C ≥ 70, D ≥ 60, E ≥ 50, otherwise F. Rows marked “not evaluated” are skipped, so a basic scan is not penalised for deep-scan checks that were not requested.