SSL/TLS Deep Audit
A thorough TLS assessment that goes well beyond a single certificate check. We probe each protocol version with its own handshake (TLS 1.0 → 1.3), inspect the certificate chain and key strength, grade forward secrecy, and evaluate HSTS and preload eligibility.
SSL/TLS Deep Audit is a Pro tool
Specialized scans are part of ONEROXE Pro. Sign in and upgrade to run the ssl/tls deep audit.
- ✓Per-version protocol probing — TLS 1.0, 1.1, 1.2 and 1.3 tested individually
- ✓Deprecated protocol detection (TLS 1.0/1.1 enabled is flagged)
- ✓Certificate chain, issuer and self-signed detection
- ✓Public key size and certificate expiry window
https://example.com/ — sample finding evidencePro from ₹349/mo ($12/mo).
What this assesses
How it works
Read-only· multiple TLS handshakes, no payloads- 1We open separate TLS handshakes for each protocol version (TLS 1.0 → 1.3) to see exactly what the server still accepts.
- 2We inspect the full certificate chain and key strength, forward-secrecy support, HSTS preload eligibility and the cipher families offered (flagging RC4/3DES/EXPORT/NULL and CBC on old TLS).
- 3All connections are read-only handshakes — no exploits are attempted.
What it doesn’t do: Node cannot negotiate SSLv3, so legacy POODLE/ROBOT-class probes that need raw SSLv3 are out of scope.
Why it matters
A valid certificate is not the same as a strong TLS configuration. Leaving TLS 1.0/1.1 enabled, shipping a weak key, or omitting HSTS quietly exposes users to downgrade and interception attacks — issues a one-line certificate checker will not surface.
Frequently asked questions
How is this different from the free SSL checker?
The free /tools/ssl check inspects the certificate from a single connection. This audit opens a separate handshake per protocol version to map exactly which are enabled, evaluates the chain and key, and checks HSTS preload eligibility.
Why does probing each TLS version matter?
Servers can accept old, insecure protocols (TLS 1.0/1.1) even while a browser negotiates a modern one. The only reliable way to know is to attempt a handshake forcing each version — which is what this tool does.
Does a passing grade mean my TLS is perfect?
It means the checked configuration is sound. Full assurance (e.g. cipher-suite ordering, certificate transparency, vulnerability-specific tests) benefits from a dedicated TLS scanner and periodic review.