--- title: Free TLS Version Checker description: See which TLS versions a server accepts — TLS 1.3, 1.2 and whether the deprecated 1.0, 1.1 and SSL 3.0 are still on — plus the cipher it negotiates, any weak suites it still accepts, and a letter grade for the whole configuration. Prove a legacy protocol is really off before an audit, or find why an old client can't connect. canonical: https://watchfor.io/tls-version-checker --- [Back to all free tools](/free-tools) # TLS Version Checker See which TLS versions a server accepts — TLS 1.3, 1.2 and whether the deprecated 1.0, 1.1 and SSL 3.0 are still on — plus the cipher it negotiates, any weak suites it still accepts, and a letter grade for the whole configuration. Prove a legacy protocol is really off before an audit, or find why an old client can't connect. [How to use this tool](/blog/how-to-check-tls-versions) Result No result yet Fill in the form above and run it — the result appears here. Monitor this 24/7 — get alerted when a failure is confirmed. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## What is TLS Version Checker ? Which versions of TLS a server accepts decides both who can connect and how safely. TLS 1.0 and 1.1 have been deprecated since 2020 and fail PCI DSS, HIPAA-adjacent audits and modern browser policies; TLS 1.2 is the floor; TLS 1.3 is faster and removes the weak options entirely. The trouble is that a server usually accepts whatever its library defaults to, and the person who configured it three years ago is not the person being audited today. This tool runs a full TLS configuration scan from a real probe: it tries each protocol version, records which the server accepts, shows the cipher the server picks for a modern client and any weak suites it still accepts, checks forward secrecy, HSTS and the certificate, and turns it into an A+ to F grade with the reasons. The protocol matrix is the part this page is about: proof that 1.0 and 1.1 are really off, and 1.3 is really on. ## How it works A grade scan is a series of handshakes, not one: - 1 Offer each version alone — A ClientHello that only offers SSL 3.0, then only TLS 1.0, 1.1, 1.2 and 1.3. A server that completes the handshake accepts that version; one that responds with protocol_version or drops the connection does not. - 2 Test the ciphers — One normal handshake records the cipher suite and key exchange the server picks. Then a TLS 1.2 hello per known-weak suite (RC4, 3DES, DES, export grades, NULL) shows whether any of them is still accepted. It is not a full per-version list of every suite the server offers. - 3 Grade the posture — Protocol versions, cipher strength, key exchange and forward secrecy, certificate validity and HSTS combine into a letter grade with an itemised list of what cost points. The scan opens a dozen or more connections and takes a few seconds — longer than a single certificate check, which is why it has a tighter rate limit. ## When you'd use it ### Before an audit PCI DSS 4.0 requires TLS 1.2 or higher; auditors verify with a scan like this one. Run it first, fix what it lists, and hand them the report. ### After hardening the config You removed TLSv1 TLSv1.1 from the nginx ssl_protocols line and reloaded. Did it take? The matrix shows exactly which versions still answer. ### An old client can't connect A legacy device or a Java 7 integration fails with a handshake error. If the server only offers 1.2+ and the client only speaks 1.0, that's the whole story — and the fix is on the client side. ### Checking every TLS port, not just 443 Mail (465, 993), databases behind TLS, MQTT, internal APIs on 8443 — each has its own protocol settings, and the mail server is often the one still accepting TLS 1.0. ## Reading the result ### Protocol matrix Green: accepted and secure (1.2, 1.3). Red: accepted and deprecated (1.0, 1.1). Struck through: not accepted. The ideal is 1.3 and 1.2 only. ### Highest protocol What a modern client will actually negotiate. 1.3 means one round-trip handshakes and no legacy cipher negotiation. ### Cipher suites and forward secrecy ECDHE key exchange gives forward secrecy — a stolen private key can't decrypt past traffic. Static RSA key exchange doesn't and is gone in 1.3. ### The grade A+ needs modern protocols, strong ciphers, forward secrecy, a valid certificate and HSTS. Each deduction names the item, so the fix list writes itself. ## Check it yourself openssl s_client -connect example.com:443 -tls1_1 &1 | grep -E 'Protocol|error' A wrong version number or unsupported protocol error means TLS 1.1 is off. Repeat with -tls1 , -tls1_2 , -tls1_3 . ## Common pitfalls ### Disabling 1.0/1.1 in the app but not the load balancer TLS terminates at the load balancer or CDN; the origin's config is irrelevant to clients. Scan the public hostname, then fix where TLS actually terminates. ### Turning off TLS 1.2 1.3-only sounds strict and locks out a surprising number of clients, including some corporate proxies and older Android. Keep 1.2 with strong ciphers unless you control every client. ### Reading a browser's padlock as proof The padlock shows the version the browser negotiated — the best one on offer. It says nothing about whether 1.0 is also accepted for anyone who asks. ## Run TLS Version Checker on every change, not just once. Get alerted when an outage is confirmed — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 15 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions Which TLS version should my server support? TLS 1.3 and TLS 1.2, nothing older. 1.2 with only AEAD ciphers (AES-GCM, ChaCha20) and ECDHE key exchange is fine for the long tail of clients; 1.3 handles everything modern. Is TLS 1.0 still allowed? Deprecated by RFC 8996 (2021), disabled in all major browsers since 2020, forbidden by PCI DSS since 2018. Nothing legitimate needs it; leaving it on only helps downgrade attacks. How do I disable TLS 1.0 and 1.1? nginx: ssl_protocols TLSv1.2 TLSv1.3; . Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3 . Cloud load balancers and CDNs expose a minimum TLS version setting. Reload, then re-scan. What is the difference between TLS 1.2 and 1.3? 1.3 removes every known-weak option (RSA key exchange, CBC, SHA-1, renegotiation), always has forward secrecy, and completes the handshake in one round-trip instead of two. It's both safer and faster. What's the difference between SSL and TLS? SSL 2.0/3.0 were the 1990s predecessors; TLS 1.0 (1999) replaced them. "SSL" survives as a word — SSL certificate, SSL grade — but every connection today is TLS. All SSL versions are disabled everywhere sane. ## Related web tools - [SSL/TLS GradeGrade a server's TLS config A+ to F — protocols, ciphers, forward secrecy, post-quantum, HSTS and certificate, with the exact reasons.](/ssl-grade-checker) - [Software Exposure CheckerSee which software versions your website reveals in its headers and HTML — web server, PHP, CMS, JavaScript libraries — and whether any is outdated, past end of life or has known CVEs. Graded A+ to F, with the fix for each. One plain GET, no signup.](/software-exposure-checker) - [PHP Version CheckerCheck your PHP version, EOL date and known CVEs — php2shell (CVE-2026-109618, CVE-2026-109619) first — from the headers your server already sends. Graded A+ to F, with the exact version to upgrade to. Passive: plain GET requests only, no signup.](/php-version-checker) - [MCP Server CheckerTest a Model Context Protocol server the way an agent does — initialize handshake, protocol version, HTTPS, sign-in discovery and the full tool inventory — and get an A+ to F grade with the exact fix for every problem. Open servers are never marked down for being open.](/mcp-server-checker) --- Canonical page: https://watchfor.io/tls-version-checker · Site guide: https://watchfor.io/llms.txt