Deep TLS analysisYour TLS configuration, inspected, graded and explained.
Deep TLS analysis inspects the certificate, the protocol versions and weak cipher suites on one verified site, grades the configuration and lists the issues worst first.
100 deep TLS scans a month on Business.
93
score out of 100
0
weak protocols
Only TLS 1.2 and 1.3 offered. From the sample report.
The highlights.
HTTPS working is not the same as HTTPS set up well. An old protocol left on, a weak cipher, a certificate about to expire: none of them shows in the padlock.
Four steps. From handshake to grade.
Verify the asset
Every scan runs against a domain you've proven you own. No scanning systems you don't control.
Inspect the handshake
We examine the certificate and its chain of trust, the protocol versions on offer, and the cipher suites that are a problem.
Grade the config
The open-source TLS testing engine behind the inspection gives the configuration a letter grade and a score out of 100.
Read the verdict
The issues are listed worst first, and an AI analysis says what they mean and what to fix.
One grade, and the reasons behind it.
The report lists the issues worst first, with an AI analysis of what they mean. Behind a CDN it shows the CDN's edge configuration, and says so.
TLS analysis report
Sample reportExample site
Overall grade
93 / 100
Protocol
TLS 1.3
Cert expiry
71 days
Weak protocols
0
AI summary
Excellent posture — A+ at 93/100, only TLS 1.2 and 1.3 offered, older protocols correctly disabled, and HSTS set to a full year. This endpoint sits behind Cloudflare, so the certificate and cipher choices are the CDN's, not your origin's. The one thing you control: if your pages return per-user secrets in compressed responses, randomize them per request to close the theoretical BREACH vector. The flagged CBC ciphers are Cloudflare's backward-compatibility set — low real-world risk.
An automated, read-only inspection, not a penetration test.
Branded, downloadable, shareable: the PDF carries the same page, ready for a review or a vendor questionnaire.
What the report counts.
Four figures from the sample analysis, and why each one matters.
A+
Overall grade
The testing engine's own letter grade for the whole configuration. The headline figure for any security or vendor review.
TLS 1.3
Protocols offered
Which TLS versions the endpoint accepts. Modern-only (1.2 and 1.3) with older versions disabled is exactly what you want to see.
71 days
Cert expiry
How long until the certificate needs renewing. Comfortable runway here means no imminent outage risk from an expired cert.
0
Weak protocols
Count of deprecated protocol versions still enabled. Zero means SSL 2/3 and TLS 1.0/1.1 are correctly turned off.
What you get.
- Up to 100 deep TLS scans every month on Business
- The certificate, six protocol versions, and weak cipher suites
- A letter grade and a score out of 100
- Expiry, weak ciphers, and protocol issues flagged
- An AI analysis of what the findings mean and what to fix
- See all features ›
Is it the right tool?
A strong fit when
- You set up HTTPS, renewed a certificate or changed your TLS settings.
- A security review asks about your TLS configuration.
- You want certificate expiry and weak protocols checked again from time to time; one inspection can be booked up to 14 days ahead.
Not the best fit when
- You only need to know that HTTPS works and is enforced. The security scan covers that.
- You want a quick look at any public site. The free SSL Certificate Checker does that.
- You need a penetration test: a person trying to break in. We do not offer one.
The analysis is read-only. It inspects the TLS reachable at your HTTPS endpoint, which behind a CDN is the CDN's edge, not your origin server.
Included in Business.
Business
100 deep TLS scans a month, 100 sites
$199 a month₹19,499 a month in India
In more detail.
What deep TLS analysis checks
A deep TLS analysis is a read-only inspection of how your HTTPS is actually configured: the certificate, its chain of trust and its expiry, the protocol versions you offer (ideally modern-only — TLS 1.2 and 1.3 — with older versions off), the cipher suites that are a problem, HSTS, and a battery of known TLS weaknesses. It is much deeper than the quick HTTPS check in the general security scan.
How the grade works
The letter grade and the score out of 100 are the testing engine's own; we do not change either. Modern-only protocols with old versions disabled, strong ciphers, a valid chain of trust, and HSTS set is what a strong result looks like; weak ciphers and deprecated protocols pull it down. It is available on the Business plan.
When to run one, and what's in the report
Run one when you first set up HTTPS, after a certificate renewal or any change to your TLS settings, before a security review, and again from time to time: a single inspection can be booked up to 14 days ahead, and it does not repeat by itself. The report is a downloadable, branded PDF that lists the findings worst first, with an AI analysis of what they mean. Example result: a grade of A+ at 93/100 — only TLS 1.2 and 1.3 offered, older protocols disabled, and HSTS set to a full year. Because this inspects the TLS reachable at your HTTPS endpoint, a site behind a CDN is showing the CDN's edge configuration rather than your origin's.
What a deep TLS analysis is not
It is an automated, read-only inspection of your transport-layer configuration — not a penetration test. It attempts no exploitation and tests no application logic. A penetration test is a separate, human-led engagement. BCDRPulse does not offer one.
Questions people ask first.
Is this a penetration test?
No. Deep TLS analysis is an automated, read-only inspection of your transport-layer configuration. It attempts no exploitation and tests no application logic. A penetration test is a separate, human-led engagement. BCDRPulse does not offer one.
My site is behind Cloudflare — what does this actually test?
It inspects the TLS configuration reachable at your HTTPS endpoint, which behind a CDN is the CDN's edge. Your origin server's own TLS is separately worth checking.
What's the difference from the security scan's TLS check?
The standard scan confirms HTTPS works and is enforced. Deep TLS goes much further — the certificate and its chain of trust, protocol versions, weak cipher suites, forward secrecy, and a battery of checks for known TLS weaknesses, with a grade.
How many deep TLS scans can I run?
Up to 100 every month on the Business plan, against any of your verified assets. The limit resets at the start of each calendar month.
What TLS grade should I aim for?
Modern-only protocols (TLS 1.2 and 1.3, with 1.0/1.1 and SSL disabled), strong cipher suites, a complete and valid certificate chain, and HSTS set. Get those right and you are at the top of the scale.
Why does certificate expiry matter?
An expired certificate throws browser security warnings and can take your site offline for visitors. The report shows how many days were left when the inspection ran; it does not send a reminder.
What are 'weak' ciphers or protocols?
Older building blocks that are no longer considered safe — for example SSL, TLS 1.0/1.1, or ciphers like RC4 and 3DES. Turning them off is one of the simplest ways to raise your grade.
Know your TLS grade, and why.
Signing up is free and starts uptime monitoring for 10 sites. Running deep tls analysis needs the Business plan.
- Grade A+, 93 out of 100 and no weak protocols are the figures in the sample report, not a customer's site.
- Allowances are per calendar month and can be used on any of your verified sites.
- Introductory prices, before GST or VAT. Regular prices are $99 and $399 a month (₹9,699 and ₹38,999 in India).