What it is
Opens a real TLS connection to the host and reports what was actually negotiated: the protocol version, the cipher suite chosen, ALPN, and whether the certificate chain validates.
Why it matters
Configuration files say what should happen. This says what does. It is the quickest way to confirm a server has genuinely stopped accepting an old protocol, or that a change you made has taken effect. Servers often keep accepting TLS 1.0 and 1.1 long after browsers dropped them, which fails standards like PCI DSS and leaves room for downgrade attacks.
Key terms
- HTTPS
- The secure version of HTTP. It sends pages over an encrypted connection, so others on the network can't read or change them.
- TLS and SSL
- The encryption behind HTTPS. SSL was the version before it, retired years ago, but the name lives on in "SSL certificate".
- TLS Handshake
- The first few messages of a secure connection, where the browser and server agree on settings, swap keys and check the certificate.
- Cipher Suite
- The mix of algorithms used to encrypt and protect a connection, agreed during the handshake. Older suites have known weaknesses.
- TLS Version
- The version of TLS the connection used. Newer versions are faster and drop weaker encryption.
- TLS 1.3
- The newest version of TLS, with a faster handshake and only strong encryption.
- TLS 1.0 and 1.1
- Old versions of TLS with known weaknesses, which every major browser dropped in 2020.
- Forward Secrecy
- Each connection gets its own temporary key, so a stolen server key can't decrypt past traffic.
- Session Resumption
- Returning visitors can reuse an earlier secure session, skipping part of the handshake.
- OCSP Stapling
- The server attaches proof that its certificate hasn't been revoked, so browsers don't have to ask the issuer.
- HTTP/2
- A faster version of HTTP that loads many files at once over a single connection.
- ALPN
- Lets the browser and server pick a protocol, such as HTTP/2, inside the TLS handshake, which saves a round trip.