What this test checks
Protocol versions
Whether SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2 and TLS 1.3 are accepted.
Cipher suites
Every TLS 1.2 suite the server accepts, with RC4, DES and 3DES, NULL, EXPORT, anonymous and MD5 suites and keys under 128 bits flagged as weak.
Forward secrecy
The share of TLS 1.2 suites that use ECDHE or DHE key exchange, plus any legacy CBC-SHA1 suites still offered.
Certificate trust and expiry
Whether browsers can build a trusted chain, whether the certificate covers your hostname and how many days it has left.
Key and signature strength
The public key type and size and the signature hash, which should be RSA 2048+ or ECDSA with SHA-256 or better.
Key exchange curves
Which elliptic curves the server supports, such as X25519 and P-256.
OCSP stapling
Whether the server staples the certificate's revocation status, which earns credit when on and costs nothing when off.
Known TLS vulnerabilities
Heartbleed, ROBOT, OpenSSL CCS injection, insecure renegotiation, TLS compression (CRIME) and missing downgrade protection.
Sample result
A real result for devteam.co.kr, tested 18 hours ago.
TLS configuration (SSLyze)
TLS scan of www.devteam.co.kr: TLS 1.2, TLS 1.3; 0 problems, 1 warning.
Cipher suites (Improve)
Legacy CBC-SHA1 suites are still offered.
7 TLS 1.2 suites · 100% forward secrecy
OCSP stapling (Info)
OCSP stapling is off. Optional: many CAs are retiring OCSP, so this matters less than it used to.
Off
Protocol versions (Good)
Only modern protocols are offered, including TLS 1.3.
TLS 1.2, TLS 1.3
Certificate trusted and matches the domain (Good)
Issued by Google Trust Services and valid for www.devteam.co.kr.
Trusted
Certificate expiry (Good)
Valid until Nov 21, 2026.
35 days left
Key and signature strength (Good)
Key size and signature algorithm are strong.
ECDSA 256 · sha256
Protocol support
How it works
- SSLyze runs on our test server in Virginia, USA, and connects to your host on port 443.
- It tries every protocol version from SSL 2.0 to TLS 1.3, lists the cipher suites accepted for each, reads the certificate chain and runs its Heartbleed, ROBOT, CCS injection, renegotiation, compression and fallback checks.
- A scan typically takes about 40 seconds and is stopped after 200 seconds at most.
- Sites without HTTPS fail immediately, because there is no TLS configuration to test.
How it is scored
The score uses our item-weighted formula: a pass earns full credit, a warning half and a fail none, with protocols, ciphers, certificate trust, certificate expiry and vulnerabilities weighted 3×, key strength 2×, and curves and OCSP stapling 1× (OCSP counts only when it is on). Grades follow our scale: A+ 95+, A 90+, B 80+, C 70+, D 60+, F below 60.
| Check | Good | Needs work | Poor |
|---|---|---|---|
| Protocol versions | TLS 1.2 and 1.3 only | TLS 1.3 not enabled | SSL 2.0/3.0 or TLS 1.0/1.1 enabled |
| TLS 1.2 cipher suites | All strong, all with forward secrecy | Some without forward secrecy, or legacy CBC-SHA1 | RC4, DES/3DES, NULL, EXPORT, anonymous, MD5 or under 128-bit |
| Certificate trust | Trusted chain that covers your hostname | — | Untrusted chain or hostname mismatch |
| Certificate expiry | 31+ days left | 15–30 days left | 14 days or less, or expired |
| Key and signature | RSA 2048+ or ECDSA, SHA-256 or better | — | Weaker key, or SHA-1/MD5 signature |
| Known vulnerabilities | None found | No downgrade protection while old protocols are on | Any vulnerability found |
| Key exchange curves | X25519, P-256, P-384 or X448 | Only uncommon curves | — |
Grades: A+ 95–100 · A 90–94 · B 80–89 · C 70–79 · D 60–69 · F below 60.