TLS Version Check

TLS Version Check tests in real time which protocols a server allows for the handshake among TLS 1.0, 1.1, 1.2 and 1.3. It attempts an actual connection with each version, reports support exactly as observed, and grades the overall configuration as safe, caution, or danger.

TLS 1.0 and 1.1 are deprecated legacy protocols; leaving them enabled exposes you to downgrade attacks and weak cipher suites. Just enter a domain — the tool probes port 443, and results are briefly cached for speed.

Why disable TLS 1.0 / 1.1

TLS 1.0 (1999) and TLS 1.1 (2006) were formally deprecated by the IETF in RFC 8996 (2021). They rely on weak hashes and cipher suites and carry known vulnerabilities like BEAST and POODLE, and standards such as PCI DSS require disabling them. If either is supported, this tool flags a caution.

TLS 1.2 / 1.3 recommended

• TLS 1.2: the widely deployed, safe baseline. Pair it with AEAD cipher suites.
• TLS 1.3: the modern version with a faster handshake and weak options removed. Enable it alongside 1.2 when possible.
• The ideal configuration supports only TLS 1.2 + 1.3 with 1.0 and 1.1 fully disabled.

Reading the result

Supporting both 1.2 and 1.3 with legacy versions off is rated safe. If 1.0 or 1.1 is enabled it is a caution — disable those protocols in your server config. If neither 1.2 nor 1.3 is supported it is a danger, meaning a secure connection is not possible. To check the certificate's expiry and chain trust alongside the protocol, use the SSL Certificate Checker as well.

TLS versions at a glance

Each version differs in release year, deprecation status, handshake round trips, and signature vulnerabilities. Here is a quick reference for how this tool grades them.

A worked example

Suppose you check example.com and the result comes back as follows.

• TLS 1.0 → supported, TLS 1.1 → supported
• TLS 1.2 → supported, TLS 1.3 → not supported

Here the modern baseline 1.2 is on, so the connection itself can be secure. But the deprecated 1.0 and 1.1 are also open, so the overall grade is caution. The fix order is: (1) disable 1.0/1.1 in your server config, then (2) add 1.3 if possible. On Nginx use ssl_protocols TLSv1.2 TLSv1.3;; on Apache use SSLProtocol -all +TLSv1.2 +TLSv1.3. Re-run the check afterward to confirm 1.0/1.1 flip to unsupported and the grade turns to safe.

Common pitfall

• Assuming “1.2 is on, so we’re safe.” Even with 1.2 enabled, leaving 1.0/1.1 open keeps a downgrade attack surface that can pull clients back to a broken version. Security is judged by the lowest version still enabled, not the highest.
• Confusing the proxy with the origin.Behind a CDN or load balancer (e.g. Cloudflare) this tool sees the proxy’s TLS settings. Check the origin server’s TLS versions separately.