SSL Analyzer

Where SSL Checker looks at the certificate itself, SSL Analyzer looks at the whole connection - every protocol version and cipher a server will actually negotiate, plus the hardening most certificate-only checks skip.

Protocol support

Which TLS versions a server accepts. TLS 1.0 and 1.1 are formally deprecated and disabled by default in every modern browser, so still offering them is a real weakness even if nothing is actively exploiting it today. TLS 1.2 and 1.3 are the versions a real browser actually negotiates now.

Cipher suite

The specific encryption algorithm a server and browser agree on for a given connection. A server can support a modern protocol and still allow a weak cipher on it - this scan tests every cipher a server accepts per protocol, not just the one your own browser happens to pick.

Key & signature strength

The certificate's own private key size (RSA below 2048 bits, or EC below 224, is considered too small to trust) and the algorithm used to sign it - MD5 is cryptographically broken outright, SHA-1 has been deprecated by every major browser since 2017. Neither shows up in a quick validity check; both only surface here.

Forward secrecy

Whether each connection uses its own temporary key instead of one long-lived server key. Without it, a single leaked private key can retroactively decrypt every past connection that was ever recorded - with it, past traffic stays safe even if the server's key is stolen later.

HSTS

A header that tells a browser to always use https:// for this domain from then on, even if someone types http:// or clicks a plain link.

Certificate revocation

A certificate can be valid, correctly matched to the domain, and still have been revoked early by its issuer - a compromised private key, for example. That's checked separately, via OCSP or a CRL, since nothing about the certificate's own dates would ever show it.

Just need a quick validity/expiry check instead? See SSL Checker.