Having a valid SSL certificate doesn't mean your TLS configuration is actually secure — weak ciphers, outdated protocols, or missing security headers can all undermine it. This guide covers thoroughly testing your setup.
Using an Online SSL Analyzer
Search for a well-known SSL testing tool (such as "SSL Labs test") and enter your domain — it provides a comprehensive grade and detailed breakdown covering protocol support, cipher strength, certificate validity, and known vulnerabilities.
What a Good Report Should Show
- TLS 1.2 and 1.3 supported; TLS 1.0/1.1 and all SSL versions disabled
- Strong cipher suites only, with forward secrecy supported
- Complete, correctly-ordered certificate chain (see Understanding Certificate Chains and Intermediate Certificates)
- No known vulnerabilities (Heartbleed, POODLE, and similar historical issues)
Command-Line Testing with OpenSSL
echo | openssl s_client -connect yourdomain.com:443 -tls1_2
echo | openssl s_client -connect yourdomain.com:443 -tls1_3Both should succeed; test that legacy protocols correctly fail:
echo | openssl s_client -connect yourdomain.com:443 -tls1
echo | openssl s_client -connect yourdomain.com:443 -tls1_1Checking Cipher Suite Strength
nmap --script ssl-enum-ciphers -p 443 yourdomain.comLists all supported cipher suites along with their strength rating — flag any weak/deprecated ciphers still being offered.
Testing for HSTS
curl -I https://yourdomain.com | grep -i strict-transportTesting OCSP Stapling
echo | openssl s_client -connect yourdomain.com:443 -status 2>/dev/null | grep -A 5 "OCSP Response"See What Is OCSP Stapling and How to Enable It if this comes back empty.
Checking for Common Security Headers
curl -I https://yourdomain.comReview the response headers for HSTS, Content-Security-Policy, X-Frame-Options, and other security headers — see Understanding HTTP Security Headers (CSP, HSTS, X-Frame-Options) for what to configure if missing.
Testing Certificate Expiration Proactively
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -enddateEstablishing a Regular Testing Cadence
TLS best practices evolve over time (new vulnerabilities discovered, previously-acceptable configurations becoming outdated) — re-test periodically, not just once at initial setup, to catch configuration drift or newly emerged concerns.
Fixing Common Issues Found
- Weak ciphers enabled — see TLS 1.2 vs TLS 1.3: Understanding and Configuring Modern TLS on Nginx & Apache for correct cipher configuration
- Missing HSTS — add the Strict-Transport-Security header
- Incomplete certificate chain — verify you're serving the fullchain file
Common Errors
Grade lower than expected despite recent configuration — verify your server actually reloaded the updated configuration (nginx -t && systemctl reload nginx); testing against stale, un-reloaded configuration is a common false alarm.
Continue Reading
- TLS 1.2 vs TLS 1.3: Understanding and Configuring Modern TLS on Nginx & Apache
- Understanding HTTP Security Headers (CSP, HSTS, X-Frame-Options)
- What Is OCSP Stapling and How to Enable It
Browse more articles in SSL/TLS & Certificates.
