How ssltest.com works

1. Submit a host

Enter a hostname (or IP address) and pick a protocol. HTTPS on port 443 is the default; 13 other protocols are supported, each connecting on its standard port unless you set one.

2. DNS resolution, everywhere

The host is resolved from five global vantage points. Every unique IP returned is scanned, so a report on a multi-region or CDN-fronted host reflects what each region actually serves, not just the resolver nearest ssltest.com.

3. A full TLS handshake per IP

ssltest.com connects to every IP the same way a browser or mail client would (including STARTTLS negotiation for SMTP, IMAP, POP3, FTP, LDAP, XMPP, and NNTP), and reads back the full certificate chain, the negotiated protocol version, cipher, and key exchange.

4. Every check, every time

There is no quick vs. extended toggle: each scan runs the complete check set at once—certificate chain validation, hostname matching (RFC 9525), supported TLS versions and ciphers, known vulnerabilities, HSTS, CAA (RFC 8659), OCSP/CRL revocation and Must-Staple (RFC 7633), Encrypted ClientHello (RFC 9849), and post-quantum key exchange (RFC 9954).

5. A grade and a shareable report

Results are combined into an A+-to-F grade and rendered as a report kept for 24 hours as a permalink. Use Re-scan for a fresh result any time; the permalink itself is never indexed by search engines.

Automation

Everything above is also available as a free, key-less JSON API (api.ssltest.com) and an MCP server (mcp.ssltest.com) for AI agents and scripts.