--- title: Free TLS Version Checker description: See which TLS versions a server accepts — TLS 1.3, 1.2 and whether the deprecated 1.0 and 1.1 are still on — plus the cipher suites offered for each, with a letter grade for the whole configuration. Prove a legacy protocol is really off before an audit, or find why an old client can't connect. canonical: https://watchfor.io/tls-version-checker --- [Back to all free tools](/free-tools) # TLS Version Checker See which TLS versions a server accepts — TLS 1.3, 1.2 and whether the deprecated 1.0 and 1.1 are still on — plus the cipher suites offered for each, with a letter grade for the whole configuration. Prove a legacy protocol is really off before an audit, or find why an old client can't connect. Result No result yet Enter the inputs above and press Run. Results appear here in a moment. Monitor this 24/7 — get alerts on the first failure. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## What is TLS Version Checker ? Which versions of TLS a server accepts decides both who can connect and how safely. TLS 1.0 and 1.1 have been deprecated since 2020 and fail PCI DSS, HIPAA-adjacent audits and modern browser policies; TLS 1.2 is the floor; TLS 1.3 is faster and removes the weak options entirely. The trouble is that a server usually accepts whatever its library defaults to, and the person who configured it three years ago is not the person being audited today. This tool runs a full TLS configuration scan from a real probe: it tries each protocol version, records which the server accepts, lists the cipher suites offered, checks forward secrecy, HSTS and the certificate, and turns it into an A+ to F grade with the reasons. The protocol matrix is the part this page is about: proof that 1.0 and 1.1 are really off, and 1.3 is really on. ## How it works A grade scan is a series of handshakes, not one: - 1 Offer each version alone — A ClientHello that only offers TLS 1.0, then only 1.1, 1.2 and 1.3. A server that completes the handshake accepts that version; one that responds with protocol_version or drops the connection does not. - 2 Enumerate cipher suites — For each accepted version, which suites the server picks and whether any weak ones (RC4, 3DES, CBC with SHA-1, export grades) are still enabled. - 3 Grade the posture — Protocol versions, cipher strength, key exchange and forward secrecy, certificate validity and HSTS combine into a letter grade with an itemised list of what cost points. The scan opens a dozen or more connections and takes a few seconds — longer than a single certificate check, which is why it has a tighter rate limit. ## When you'd use it ### Before an audit PCI DSS 4.0 requires TLS 1.2 or higher; auditors verify with a scan like this one. Run it first, fix what it lists, and hand them the report. ### After hardening the config You removed TLSv1 TLSv1.1 from the nginx ssl_protocols line and reloaded. Did it take? The matrix shows exactly which versions still answer. ### An old client can't connect A legacy device or a Java 7 integration fails with a handshake error. If the server only offers 1.2+ and the client only speaks 1.0, that's the whole story — and the fix is on the client side. ### Checking every TLS port, not just 443 Mail (465, 993), databases behind TLS, MQTT, internal APIs on 8443 — each has its own protocol settings, and the mail server is often the one still accepting TLS 1.0. ## Reading the result ### Protocol matrix Green: accepted and secure (1.2, 1.3). Red: accepted and deprecated (1.0, 1.1). Struck through: not accepted. The ideal is 1.3 and 1.2 only. ### Highest protocol What a modern client will actually negotiate. 1.3 means one round-trip handshakes and no legacy cipher negotiation. ### Cipher suites and forward secrecy ECDHE key exchange gives forward secrecy — a stolen private key can't decrypt past traffic. Static RSA key exchange doesn't and is gone in 1.3. ### The grade A+ needs modern protocols, strong ciphers, forward secrecy, a valid certificate and HSTS. Each deduction names the item, so the fix list writes itself. ## Check it yourself openssl s_client -connect example.com:443 -tls1_1 &1 | grep -E 'Protocol|error' A wrong version number or unsupported protocol error means TLS 1.1 is off. Repeat with -tls1 , -tls1_2 , -tls1_3 . ## Common pitfalls ### Disabling 1.0/1.1 in the app but not the load balancer TLS terminates at the load balancer or CDN; the origin's config is irrelevant to clients. Scan the public hostname, then fix where TLS actually terminates. ### Turning off TLS 1.2 1.3-only sounds strict and locks out a surprising number of clients, including some corporate proxies and older Android. Keep 1.2 with strong ciphers unless you control every client. ### Reading a browser's padlock as proof The padlock shows the version the browser negotiated — the best one on offer. It says nothing about whether 1.0 is also accepted for anyone who asks. ## Run TLS Version Checker on every change, not just once. Get alerts the moment something breaks — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 10 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions Which TLS version should my server support? TLS 1.3 and TLS 1.2, nothing older. 1.2 with only AEAD ciphers (AES-GCM, ChaCha20) and ECDHE key exchange is fine for the long tail of clients; 1.3 handles everything modern. Is TLS 1.0 still allowed? Deprecated by RFC 8996 (2021), disabled in all major browsers since 2020, forbidden by PCI DSS since 2018. Nothing legitimate needs it; leaving it on only helps downgrade attacks. How do I disable TLS 1.0 and 1.1? nginx: ssl_protocols TLSv1.2 TLSv1.3; . Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3 . Cloud load balancers and CDNs expose a minimum TLS version setting. Reload, then re-scan. What is the difference between TLS 1.2 and 1.3? 1.3 removes every known-weak option (RSA key exchange, CBC, SHA-1, renegotiation), always has forward secrecy, and completes the handshake in one round-trip instead of two. It's both safer and faster. What's the difference between SSL and TLS? SSL 2.0/3.0 were the 1990s predecessors; TLS 1.0 (1999) replaced them. "SSL" survives as a word — SSL certificate, SSL grade — but every connection today is TLS. All SSL versions are disabled everywhere sane. ## Related web tools - [SSL/TLS GradeGrade a server's TLS config A+ to F — protocols, ciphers, forward secrecy, post-quantum, HSTS and certificate, with the exact reasons.](/ssl-grade-checker) - [MCP Server CheckerTest a Model Context Protocol server: initialize handshake, protocol version, capabilities and the full tool inventory.](/mcp-server-checker) - [SSL Certificate CheckInspect certificate validity, expiry, SANs, issuer and chain trust.](/ssl-checker) - [HTTP HeadersInspect response headers, status, redirect chain and security headers.](/http-header-checker) --- Canonical page: https://watchfor.io/tls-version-checker · Site guide: https://watchfor.io/llms.txt