TLS Version Checker
Test which TLS versions a server accepts: TLS 1.0, 1.1, 1.2 and 1.3, each tried on its own, with the cipher negotiated and a warning if deprecated versions are still enabled. Enter a hostname such as example.com, or example.com:8443.
- Free
- No signup required
- Live TLS handshake
Common TLS version problems
TLS 1.0 or 1.1 still enabled
Both versions are formally deprecated by RFC 8996, and current browsers no longer use them. Leaving them on adds no compatibility for real visitors and may fail a PCI DSS scan or a customer's security review. Disable them in your server or load balancer settings.
No TLS 1.3
TLS 1.3 has a faster handshake and removes old, weak options. It is usually missing because the server or its OpenSSL version is old, or the configuration lists only older versions. In nginx, add TLSv1.3 to ssl_protocols; on a managed load balancer, choose a newer security policy.
Neither TLS 1.2 nor TLS 1.3
If the server accepts only TLS 1.0 or 1.1, modern browsers, curl and most API clients cannot connect at all. This is urgent: upgrade the server software or put it behind a proxy or CDN that terminates TLS for it.
Old clients break after disabling TLS 1.0
Very old Android versions, legacy Java runtimes and some embedded devices only speak TLS 1.0. If you must support them, give them a separate hostname rather than keeping old versions on for everyone.
Settings changed but nothing is different
The TLS connection often ends at a CDN or load balancer in front of your server, such as Cloudflare or an AWS load balancer. Changing nginx on the origin has no effect on what visitors see; change the setting where TLS actually terminates.
How to check TLS versions
- Enter the hostname, with :port if the service is not on 443.
- Click Check TLS versions.
- See which of TLS 1.0, 1.1, 1.2 and 1.3 the server accepts and the cipher for each.
- Disable any version flagged as deprecated, reload the server and check again.
What are TLS versions?
TLS (Transport Layer Security) is the protocol that encrypts HTTPS and most other secure connections. It has four versions in use or recently retired: TLS 1.0 (1999), TLS 1.1 (2006), TLS 1.2 (2008) and TLS 1.3 (2018). SSL 2.0 and 3.0 came before them and are long gone.
At the start of every connection the client lists the versions it supports and the server picks the highest one both sides share. A server that still accepts an old version lets any client choose it, which is why deprecated versions should be switched off rather than just ranked lower.
RFC 8996 (2021) formally deprecated TLS 1.0 and 1.1. Today a sensible server accepts TLS 1.2 and TLS 1.3 and nothing older. This checker tries each version on its own, so you see exactly what the server allows, not only what your browser negotiated.
# nginx ssl_protocols TLSv1.2 TLSv1.3; # Apache SSLProtocol -all +TLSv1.2 +TLSv1.3
When to use a TLS version checker
Preparing for a security review or PCI scan
Confirm TLS 1.0 and 1.1 are off before a customer questionnaire or a PCI DSS scan finds them for you.
After changing nginx or Apache settings
Check that the new ssl_protocols or SSLProtocol line is live, and that you did not switch off TLS 1.2 by accident.
Choosing an AWS or Azure load balancer policy
Managed load balancers pick TLS versions through a named security policy. Check what the policy you chose really allows.
Debugging an old client that cannot connect
A legacy device or Java app fails after a server upgrade. See which versions remain and whether the client can share any of them.
Check something else
- SSL CheckerCheck a site's SSL certificate, expiry date and whether the intermediate certificate is installed.
- Security Headers CheckerGrade a site's HTTP security headers (HSTS, CSP, X-Frame-Options and more) from A+ to F.
- Bulk SSL CheckerCheck SSL certificates for up to 50 hostnames at once: expiry, days left, chain and issuer, with CSV export.
- Port CheckerCheck if a TCP port is open, closed or filtered on a host, with the connect time.
Frequently asked questions
Which TLS versions should my server support?
TLS 1.2 and TLS 1.3. Both are current and every modern browser and HTTP library supports at least one of them. TLS 1.0 and 1.1 are deprecated.
Is it safe to disable TLS 1.2 and keep only TLS 1.3?
For a modern audience it often works, but some older operating systems, Java versions and corporate proxies still lack TLS 1.3. Keeping TLS 1.2 on is the usual choice for a public site or API.
Why does the checker show a different cipher for each version?
Each version has its own set of cipher suites. TLS 1.3 defines only a few modern ones, while TLS 1.2 servers can offer many, so the server picks separately for each.
Does Cloudflare let me turn off TLS 1.0?
Yes. Cloudflare has a minimum TLS version setting for each zone under SSL/TLS settings. Set it to TLS 1.2 to stop accepting 1.0 and 1.1 at the edge.
Is this a full security scan?
No. It tests which protocol versions the server accepts and the cipher chosen for each. Use the SSL Checker for the certificate and chain.
Catch the outage, not just the setting
A config change that drops the wrong TLS version can take a site offline for every client at once. TinyPing checks your site every 5 minutes and alerts you when:
- the HTTPS connection fails
- the certificate is close to expiring (14, 7, 3 and 1 days before)
- the site returns an error or times out
US$6.99 a month or US$47 a year per 50 monitors, team members free. 7-day free trial, no card needed.
Want alerts in team chat? Follow the guide for Slack or Google Chat.