SSL/TLS / configuration analyzer
Grade a TLS configuration offline
Paste output from sslscan, testssl.sh, nmap, sslyze or openssl s_client and get an SSL Labs grade with the full derivation, every finding explained, the cipher suite table classified, compliance mapping, and the configuration to fix it. The SSL Labs Rating Guide is implemented here, in your browser — so internal and staging hosts get a real grade, which SSL Labs itself cannot provide because it has to reach the host to test it.
Scan output
Paste more than one scan in sequence if you have them — sslscan enumerates ciphers best, testssl.sh covers the vulnerability set best. Everything is parsed locally and never leaves this tab.
Capture the scan
5 toolsRun it wherever you have network access to the target — including inside a segment no public scanner can reach — then paste the output above.
Why this tool has no “enter a URL” mode, unlike the header analyzer. Reading a site's headers needs one HTTP request, so a small service can make it for you. Enumerating a TLS configuration needs dozens of handshakes, each deliberately offering one specific cipher suite and protocol version, and reading what the server selects. A browser cannot choose a cipher suite at all — there is no API for it — and no public service exposes that capability over CORS.
So this is a genuine limit, not a shortcut: an online mode here would need a hosted scanner running sslscan or testssl.sh. Running the scanner yourself is also strictly better, because it reaches internal hosts, uses your own network path, and sends nothing about your target to a third party.
Paste scan output above, then press Analyze.
Findings
Cipher suites
Sorted weakest first. Every suite is classified by key exchange, authentication, mode, forward secrecy and AEAD, from its name.
| Suite | Protocol | Bits | Kx / Auth | Mode | Properties | Issues |
|---|
Compliance
TLS requirements onlyRecommended configuration
Mozilla profilesClient compatibility
From testssl.sh client simulations. This is the answer to “will disabling TLS 1.0 break anything?”
Scan limitations
Reference
The questions this tool exists to answer.
How do I get an SSL Labs grade for an internal server?
Run the scan yourself and paste it here. SSL Labs has to reach the
host to test it, so it is unusable for anything behind a VPN, on an internal segment,
or answering only to a particular Host header — which is most of
what gets tested on an engagement.
The Rating Guide is implemented in this page, so the grade is computed in your browser from output you captured. Nothing is uploaded, and the derivation is shown in full so you can check the arithmetic rather than trust it.
Why is my grade capped at B?
A cap overrides the numeric score entirely, so an otherwise perfect configuration still lands at B. The causes:
| Cap | Trigger |
|---|---|
| A- | TLS 1.3 not supported, or HSTS missing or invalid |
| B | TLS 1.0 or 1.1 offered · RC4 offered · incomplete chain · DH under 2048 bits · no forward secrecy · no AEAD suite |
| C | CRIME (TLS compression) · no TLS 1.2 · RC4 or 3DES offered on TLS 1.1+ |
| F | SSL 2.0 · insecure renegotiation · Heartbleed · CCS injection · DROWN · Ticketbleed · ROBOT · the POODLE variants · EXPORT suites · expired, self-signed or untrusted certificate · key under 1024 bits · DH under 1024 bits |
A+ needs a clean configuration with no caps and HSTS with
max-age of at least six months.
Is 3DES a finding if it only appears on TLS 1.0?
Yes, but it is scored differently — and this is where tools disagree. SWEET32 applies to any 64-bit block cipher, so 3DES is a finding wherever it appears. The SSL Labs cap at C, though, only applies when 3DES is offered on TLS 1.1 or newer. If it appears solely under TLS 1.0, the TLS 1.0 cap at B governs instead.
This distinction is easy to get wrong: testing whether the server supports TLS 1.1+ anywhere rather than whether the suite is offered on it produces a C where the correct answer is B.
sslscan or testssl.sh — which should I use?
Both, and paste both. They are good at different things:
| sslscan | testssl.sh | nmap | |
|---|---|---|---|
| Speed | seconds | minutes | seconds |
| Cipher enumeration | complete, per protocol, with bits | complete with -e | complete, with its own grades |
| Vulnerability checks | Heartbleed only | the full set | a few scripts |
| Certificate detail | good | extensive | good |
| Client simulation | no | ~35 clients | no |
| Machine-readable | no | --jsonfile | -oX |
Cipher-strength scoring depends on the weakest suite found, so the more completely the source enumerated suites, the more accurate — and usually the lower — the score. A partial enumeration flatters the target.
Will disabling TLS 1.0 break old clients?
It breaks clients older than roughly 2015: Android 4.3 and earlier, Java 6 and unpatched 7, Windows XP with IE 8, and OpenSSL before 1.0.1. Every current browser has supported TLS 1.2 since 2013.
You do not have to guess. testssl.sh runs about 35 client simulations, and pasting its JSON here surfaces exactly which of them would fail — which turns “we might break someone” into a list you can put in a change request.
What does PCI DSS actually require for TLS?
No SSL 2.0 or 3.0. No TLS 1.0 — the removal deadline was 30 June 2018. No TLS 1.1 for new implementations. No EXPORT suites, no RC4, and a valid certificate. TLS 1.2 or later with strong ciphers is the baseline.
This tool maps each scan against PCI DSS 4.0, NIST SP 800-52r2 and the HIPAA Security Rule, and names the specific failing requirement rather than just failing you. It covers the transport-security requirements only — it is not an audit.