Web-PSQC
Performance
Global load speed Core Web Vitals (Lighthouse) Mobile experience Load test (k6)
Security
SSL/TLS security (testssl.sh) TLS configuration (SSLyze) Security headers Vulnerability scan (OWASP ZAP) CVE scan (Nuclei)
Quality
Accessibility (WCAG) Browser compatibility Responsive layout
SEO
SEO essentials Meta tags & link previews Structured data Crawlability: robots.txt & sitemap Site crawl & broken links Google presence
AI visibility
AI crawler access AI answer readiness What AI says about you
Web-PSQC
Pricing Certificate Blog Sign in Test a website

SSL/TLS security test with testssl.sh

Check how securely your server encrypts traffic before a browser warning or a failed audit tells you. testssl.sh connects to your server on port 443 and tests the certificate, every SSL/TLS protocol version, the cipher suites and 18 known TLS attacks, then rates the setup with the SSL Labs grading method. Every problem comes with a suggested fix.

Runs only this test. Want everything? Run all 18 tests from the home page.

What this test checks

SSL Labs-style rating

testssl.sh's letter grade and 0–100 score, calculated with the SSL Labs rating guide, with the reasons for any grade cap.

Protocol versions

Which of SSL 2, SSL 3, TLS 1.0, TLS 1.1, TLS 1.2 and TLS 1.3 the server offers.

Certificate

Chain of trust, hostname match, days until expiry, issuer, key size, signature algorithm and OCSP stapling.

Known TLS vulnerabilities

Heartbleed, ROBOT, POODLE, DROWN, FREAK, Logjam, BEAST, SWEET32, Lucky13, CRIME, BREACH and the rest of 18 known attacks.

Downgrade protection

Whether the server supports TLS_FALLBACK_SCSV, which stops attackers from forcing a connection onto an older protocol.

Cipher suites and forward secrecy

Whether weak cipher categories (NULL, anonymous, EXPORT, LOW, 3DES) or obsolete CBC ciphers are offered, and whether forward secrecy is supported.

DNS CAA record

Whether a CAA record limits which certificate authorities may issue certificates for your domain.

Sample result

A real result for devteam.co.kr, tested 17 hours ago.

SSL/TLS security (testssl.sh)

testssl.sh rating A+ (96/100) for www.devteam.co.kr: TLS 1.2, TLS 1.3.

96/100A+
Known TLS vulnerabilities (Improve)
Possible BREACH exposure: potentially VULNERABLE, br gzip HTTP compression detected - only supplied '/' tested. This only matters if compressed pages reflect user input next to secrets (such as CSRF tokens).
1 found
Target: Not vulnerable
How to fixKeep secrets out of compressed responses that echo user input, or mask CSRF tokens per request.
Cipher suites & forward secrecy (Improve)
Strong ciphers with forward secrecy are offered, but some obsolete CBC ciphers are still enabled.
Forward secrecy
Target: Strong AEAD ciphers with forward secrecy
How to fixRemove CBC-mode cipher suites (keep AES-GCM and ChaCha20-Poly1305).
DNS CAA record (Improve)
No CAA record: any certificate authority may issue certificates for your domain.
Missing
Target: Restricts which CAs may issue certificates
How to fixAdd a DNS CAA record naming your CA, e.g. 0 issue "letsencrypt.org".
SSL/TLS rating (SSL Labs method) (Good)
testssl.sh rates this server A+ using the SSL Labs grading guide.
A+ · 96/100
Target: A or A+
Protocol versions (Good)
Only TLS 1.2 and TLS 1.3 are offered.
TLS 1.2, TLS 1.3
Target: TLS 1.2 + TLS 1.3 only
Certificate validity (Good)
Trusted chain from WE1 (Google Trust Services from US), EC 256 bits (curve P-256), ECDSA with SHA256.
36 days left
Target: Trusted chain, matches host, > 30 days left
A+Rating (SSL Labs method)
36 daysCertificate valid for
TLS 1.2 · TLS 1.3Protocols offered
IssuerWE1 (Google Trust Services from US)
KeyEC 256 bits (curve P-256)
SignatureECDSA with SHA256
Expires2026-11-21 06:13
Names covereddevteam.co.kr *.devteam.co.kr
OCSP staplingnot offered

testssl.sh checked 19 known TLS attacks · low-risk notes: Lucky13.

How it works

  1. testssl.sh runs on our test server in Virginia, USA, and connects to your host on port 443.
  2. It tests one IP address of your host: protocols, cipher suites, forward secrecy, the certificate and known vulnerabilities, and it simulates connections from common browsers and devices.
  3. Vulnerability checks use crafted TLS handshakes to detect weaknesses; nothing on your server is changed.
  4. A full scan typically takes about 2 minutes with live progress, and it is stopped after 7 minutes at most.
  5. Sites that do not use HTTPS fail immediately, because there is no TLS setup to test.

How it is scored

The test score is testssl.sh's final score (0–100), calculated with the SSL Labs rating guide from protocol support (30%), key exchange (30%) and cipher strength (40%), and our A+ to F grade comes from that score. testssl.sh's own letter rating, which is capped for problems such as old protocols and needs HSTS for an A+, is shown as the first check.

CheckGoodNeeds workPoor
testssl.sh ratingA+, A or A-BC or lower
Protocol versionsTLS 1.2 and 1.3 onlyTLS 1.0/1.1 offered, or no TLS 1.3SSL 2 or SSL 3 offered
CertificateTrusted, matches the host, 31+ days left15–30 days left14 days or less, expired, untrusted or wrong name
Known vulnerabilitiesNone foundBREACH only (HTTP compression)Any other at medium severity or higher
Ciphers and forward secrecyStrong ciphers with forward secrecyObsolete CBC ciphers still enabledWeak cipher categories, or no forward secrecy
DNS CAA recordPresentMissing—
Test score (testssl.sh final score)90–100 (A or A+)70–89 (B or C)Below 70 (D or F)

Grades: A+ 95–100 · A 90–94 · B 80–89 · C 70–79 · D 60–69 · F below 60.

FAQ

How do I check my SSL certificate and TLS configuration?
Enter your domain and run this test. testssl.sh connects to your server and reports the certificate's trust chain and expiry date, the TLS versions and cipher suites offered, and any known TLS vulnerabilities, with a rating based on the SSL Labs method.
Is this the same as the SSL Labs test?
No. It is a separate test that uses the open-source testssl.sh scanner, not Qualys SSL Labs. testssl.sh grades by the same published SSL Labs rating guide, but the two tools test slightly differently, so results can differ.
How do I get an A+ SSL rating?
Offer only TLS 1.2 and TLS 1.3, use strong ciphers with forward secrecy (ECDHE with AES-GCM or ChaCha20-Poly1305), and serve a trusted certificate with its full chain. Then add an HSTS header with a long max-age, which the SSL Labs method requires for an A+. Mozilla's "intermediate" server configuration is a good starting point.
Should I disable TLS 1.0 and TLS 1.1?
Yes. Browsers dropped TLS 1.0 and 1.1 in 2020, and both versions have known weaknesses. This test marks them as needing work and they cap the testssl.sh rating, while SSL 2 and SSL 3 count as a fail.
What happens when my SSL certificate is about to expire?
The certificate check turns to a warning when 30 days or fewer are left and to a fail at 14 days or fewer, or once the certificate has expired. Browsers show a full-page security warning for an expired certificate, so set up automatic renewal (for example with certbot, acme.sh or your CDN) and check that it runs.