TLS and certificate review
Thirteen checks that take a TLS deployment apart in the order the handshake builds it: what the server offers, what it agrees to, what it proves, and what it tells the browser to remember. Run the whole list after a certificate rotation, because rotation is when the parts stop agreeing with each other and nothing reports it. Every item here is read from a live handshake rather than from a configuration file, since the file on disk and the process in memory are different things and only one of them answers requests.
14 checksabout 82 min end to end
What the server offers
- How to check TLS version of a website
The negotiated version is the ceiling on everything below it, and the tools disagree about how to report it. - How to check if a website supports TLS 1.3
Its absence is not an error anywhere, so it goes unnoticed until someone asks. - How to check if TLS 1.0 is disabled
Prove the refusal with a positive control, or you have only proved your own client cannot ask. - How to check cipher suites of a server
A version can be current while the suite set behind it is not, and one weak suite is enough. - How to check the TLS handshake
The message exchange shows where a failure happens, which a pass or fail verdict never does.
What the certificate proves
- How to check SSL certificate from command line
Read the fields off the live server before reading anything else, so the rest of the list has a subject. - How to check SSL certificate expiry
The only item here with a deadline attached, and the one a monitor can actually own. - How to check certificate SAN
The name list drifts at every reissue, silently, while the certificate stays valid. - How to check certificate chain
A missing intermediate works in your browser and fails on a client with a cold store. - How to check if a certificate is self-signed
Tells you whether you are looking at a real trust failure or at a staging certificate that escaped.
Revocation
- How to check certificate revocation
Two clients on one machine can reach opposite verdicts, so know which one your users run. - How to check if OCSP stapling is enabled
Stapling has no failure signal. The handshake succeeds either way and only a strict client pays.
What the browser remembers
- How to check if HSTS is enabled
The header that makes the whole list apply to the visitor's next request without asking. - How to check HSTS preload status
Preload is difficult to undo, so confirm the policy is the one you want before submitting it.
Take it with you
The file is the same list as Markdown checkboxes, ready to paste into a release ticket or a pull request description.
Ticks are kept in this browser only. They are not sent anywhere and other people do not see them.