See which TLS versions a server accepts, 1.0 to 1.3, and whether weak ciphers are still on
Checked from our server in India. Only the address you type is sent to us; nothing else leaves your device. Checked against sources on 16 Oct 2026.A TLS version checker connects to a server once per protocol version and reports which versions it accepts. This one tries TLS 1.3, 1.2, 1.1 and 1.0 from our server in India, then the retired TLS 1.2 cipher families, and flags TLS 1.0 and 1.1, deprecated since 2021, and weak ciphers that are still switched on.
Type the domain, and change the port if the service is not on 443.
Press Check TLS. Our server makes one handshake per version, one at a time.
Read Accepted or Refused for each version and cipher family, then copy the report.
A server accepts a range of TLS versions, but an ordinary connection shows only the one it picks, which is almost always the newest. The only way to learn the whole range is to offer each version on its own and see whether the server agrees. That is what this checker does: four handshakes, one each for TLS 1.3, 1.2, 1.1 and 1.0, sent from our server to the address the domain resolves to, with the domain as the server name.
When TLS 1.2 is accepted, four more handshakes test the cipher families that RFC 9325 advises against and RFC 7465 forbids: RSA key exchange (no forward secrecy), CBC-mode suites, 3DES and RC4. A modern server refuses all four.
TLS 1.3 accepted is the goal; TLS 1.2 accepted is still needed by older clients. TLS 1.1 or 1.0 accepted is a failure: both were deprecated by RFC 8996 in March 2021, and browsers stopped accepting them in 2020. RSA key exchange, CBC suites and 3DES are warnings (RFC 9325 says they should not be negotiated); RC4 is a failure, because RFC 7465 forbids it.
The certificate is the SSL Checker's job. A row marked Not tested means our own OpenSSL build cannot offer that version or cipher at all (3DES and RC4 are often compiled out), so nothing was learned about the server. A service that upgrades with STARTTLS, such as mail on port 25, cannot be tested here. Results describe the server our connection reached from India; a CDN can answer differently elsewhere.
Type the domain and press Check TLS. Our server makes one handshake per version, offering only TLS 1.3, then only 1.2, 1.1 and 1.0, and records whether each one completes. The table shows Accepted or Refused for every version, so the whole supported range is visible, not just the newest.
Yes. RFC 8996 deprecated both in March 2021 and says they must not be used, and Chrome, Firefox, Safari and Edge stopped accepting them in 2020. Set the minimum protocol to TLS 1.2 in the web server, load balancer or CDN settings.
Yes, when it is limited to forward-secret AEAD suites such as ECDHE with AES-GCM or ChaCha20. RFC 9325 still requires TLS 1.2 support. What makes TLS 1.2 weak is the old suites it can carry, which is why the checker also tests RSA key exchange, CBC, 3DES and RC4.
Our server's own TLS library could not offer that version or cipher at all, so nothing was learned about the target. 3DES and RC4 are often removed from modern OpenSSL builds. Not tested is never counted as Refused or Accepted, and the report names each row it affects.
With RSA key exchange the session key is sent encrypted with the server's long-term key. Anyone who records the traffic and later obtains that key can decrypt every past session. ECDHE key exchange gives forward secrecy instead, which is why RFC 9325 advises against RSA key exchange.
No. This page tests protocol versions and cipher families only. For the certificate's expiry, names, issuer and chain, use the SSL Checker on the same domain. For the HTTP version a site uses on top of TLS, use the HTTP/2 and HTTP/3 Checker.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about TLS Version Checker and anybody who knows can answer. No account needed.
Also works as: TLS 1.0 and 1.1 Checker.
Same job, other tools: AAAA Record Lookup (IPv6) – Check whether a domain has an IPv6 address, and what it is · CAA Record Lookup – See which certificate authorities a domain allows to issue its SSL certificates · DS Record Lookup – Read the DS record the parent zone holds and see whether it matches a published key · Domain Expiry Checker – Domain expiry check: the registry’s own expiry date, with the days left counted.