Free TLS Version Checker
Instantly check which TLS version a domain negotiates — detect deprecated TLS 1.0/1.1 and verify TLS 1.3 support. Free, no account required.
TLS Version Security Overview
| Version | Grade | Status | Details |
|---|---|---|---|
| TLS 1.3 | A+ | Recommended | The latest standard. Faster (1-RTT handshake), stronger security, and all weak cipher suites removed. Use this wherever possible. |
| TLS 1.2 | A | Acceptable | Widely used and secure when configured with strong cipher suites. Supported by all modern browsers. Should be your minimum standard. |
| TLS 1.1 | C | Deprecated | Deprecated in March 2021 (RFC 8996). No longer supported by major browsers. Disable immediately. |
| TLS 1.0 | D | Insecure | Deprecated in March 2021. Vulnerable to BEAST and POODLE attacks. Disable immediately. Required for PCI DSS compliance. |
| SSLv3 / SSLv2 | F | Critical | Critically insecure. Vulnerable to POODLE and DROWN attacks. Should never be enabled on any server. |
Frequently Asked Questions
What TLS version should my server use?
You should support TLS 1.2 and TLS 1.3. TLS 1.3 is the latest and most secure version, offering improved performance through 0-RTT handshakes and stronger cipher suites. TLS 1.0 and TLS 1.1 are deprecated and should be disabled immediately — they are vulnerable to BEAST, POODLE, and other attacks.
How do I upgrade my server to TLS 1.3?
For Nginx: set ssl_protocols TLSv1.2 TLSv1.3; For Apache: SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1. Ensure your OpenSSL version is 1.1.1 or later. On cloud services like Cloudflare, AWS CloudFront, or Azure CDN, you can configure the minimum TLS version in the control panel.
What are cipher suites?
Cipher suites are sets of cryptographic algorithms used during the TLS handshake to establish a secure connection. A cipher suite specifies the key exchange algorithm, the bulk encryption algorithm, and the message authentication code (MAC). TLS 1.3 simplified this by removing weak options — it only supports five cipher suites, all of which are considered secure.
What is a TLS handshake?
The TLS handshake is the process by which a client and server establish a secure connection. It includes version negotiation, certificate exchange, key exchange, and cipher suite selection. TLS 1.3 reduced the handshake to 1-RTT (round trip) versus TLS 1.2's 2-RTT, making it significantly faster.
What is the difference between TLS 1.2 and TLS 1.3?
TLS 1.3 is faster (1-RTT handshake vs 2-RTT), supports only 5 secure cipher suites (removing outdated ones), uses forward secrecy by default, and encrypts more of the handshake. It removes RSA key exchange, making all connections use Diffie-Hellman. TLS 1.2 is still widely used and secure when configured properly, but TLS 1.3 is the recommended standard.
Monitor TLS Configuration Continuously
TLS configurations can change after server updates or cloud provider changes. CertNotify monitors your TLS versions and alerts you if a downgrade is detected.