TLS Version Check & Grade
Four handshakes, one per protocol version, plus the certificate and HSTS — scored, with the reasoning left in view rather than hidden behind a letter.
What this tool does
Opens one TLS connection per protocol version — 1.0, 1.1, 1.2 and 1.3 — pinned so that each answers a single question: will this server still talk to a client that only speaks this? It then reads the certificate off the newest connection that worked, checks the chain, asks for the Strict-Transport-Security header, and reduces the lot to one letter.
Every check states what it did to the grade. Nothing is weighted invisibly, so a B always has a named cause you can go and fix.
What it is not
This is not SSL Labs and does not try to be. A full assessment enumerates every cipher suite against every protocol version — hundreds of handshakes per host — and detects attacks that need a hand-written ClientHello to probe for. Go's TLS stack will not even offer the legacy suites such a test would have to try, so a scan built on it would quietly under-report the exact weaknesses it was asked about. Five handshakes answer the questions that can be answered honestly; for a full audit, use Qualys SSL Labs.
How the grade is worked out
The grade starts at A+ and is only ever lowered. Whichever check pulls hardest decides the result:
- F — a browser would show a warning before it showed the site: the certificate is expired, the name does not match, the chain does not lead to a public CA, the key is under 2048 bits, the signature is SHA-1, or neither TLS 1.2 nor 1.3 is accepted.
- C — the chain is incomplete. The intermediate is missing and had to be downloaded from the CA to make it verify. Desktop browsers usually paper over this from cache; phones, API clients and older Androids do not.
- B — TLS 1.0 or 1.1 is still accepted, the negotiated suite has no forward secrecy, or the certificate expires within a week. Each of these is something an audit or a PCI DSS scan will raise.
- A — nothing a browser objects to. TLS 1.3 missing, or HSTS absent or shorter than a year, keeps it from A+.
- A+ — TLS 1.3, no deprecated protocols, a chain that verifies, and HSTS held for a year or more.
Why TLS 1.0 and 1.1 still matter
Browsers stopped using them in 2020 and PCI DSS has forbidden them since 2018, so leaving them enabled serves no visitor you have — only scanners, old bots and whatever is looking for a downgrade. Turning them off is a one-line change in every server this site has an install guide for.
Common problems
- Every version failed. The host does not serve TLS on that port, requires a client certificate, or is blocking this server. Add a port if the service is not on 443:
example.com:8443. - TLS 1.0 shows as supported but you disabled it. Something in front of the origin — a load balancer, a CDN, an older proxy — is terminating TLS with its own settings. This tool reports whatever answered.
- The grade is C but the site looks fine. That is exactly the failure mode of an incomplete chain. The chain builder produces the bundle that fixes it.