Deep TLS analysisAll features.
Everything a Deep TLS analysis does today: what it inspects, where the grade comes from, and what is in the report.
27 features in 7 groups, checked against the product on 14 November 2026.
What it checks
Six protocol versions
SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2 and TLS 1.3: whether the server offers each one. The first four are marked as deprecated.
The certificate
Its expiry date and the days left, the dates it is valid between, the key size, the signature algorithm, who issued it, and whether the chain leads to a trusted root.
Revocation and transparency
OCSP stapling, the certificate's revocation list address, and Certificate Transparency.
Configuration
The HSTS max-age, forward secrecy, the domain's CAA record, whether a client certificate is asked for, and the server's banner.
Flagged issues
Every finding the engine rates as low or worse, the worst first. Weak cipher suites and known TLS weaknesses appear here when the server has them.
It says when it met a CDN
When the server's banner names a content delivery network, the result is labelled as that network's edge and not your own server.
Port 443, one address
The inspection connects to port 443 at the first address the host resolves to.
The grade
The engine's grade and score
A letter and a score out of 100, taken from the open-source TLS testing engine that does the inspection. We do not change either.
A risk rating in the PDF
Elevated, Moderate or Low, from the most severe issue found.
The AI analysis
Three parts
A verdict, what it means and what to fix, in under 240 words, written from the grade, the protocols, the certificate facts and the flagged issues.
Saved first
The inspection's results are saved before the AI is asked, so a failed analysis loses nothing.
The report
In the dashboard
The grade, the protocol versions, the certificate and configuration facts, the flagged issues and the AI analysis.
As a PDF
Cover with a report ID, executive summary, a count of issues by severity, scope and method, the findings from the worst down, a table of obsolete cipher suites, three appendices (protocols, certificate and configuration, the key checks), trend and recommendations.
Written fixes
For six families of finding: BREACH, LUCKY13, SWEET32, ROBOT, obsolete cipher lists and CBC ciphers. Other findings carry a general line.
Trend
The grade and the score beside the previous finished inspection of the same site.
Combined report
On the Reports page up to 50 reports, from this product and the others, can be merged into one PDF with a cover and a contents page.
History
The page shows your 10 most recent inspections and any still waiting.
Running it
Run now or book for later
A single inspection can be booked for a time up to 14 days ahead; up to 10 can be booked at once.
One inspection at a time
One of yours runs at a time; others wait in the queue.
Cancel from the Jobs page
A waiting, booked or running inspection can be cancelled.
A run that hangs is closed
An inspection with no result after 15 minutes is marked as failed.
Ownership and safety
Verified sites only
A run is accepted only for a site of yours whose DNS record has been confirmed, and the site is checked again when the run starts.
Public addresses only
A host that does not resolve to a public address is refused when you ask for the run and again before it starts.
Read-only
The engine opens connections and reads what the server offers. It attempts no exploitation and sends no load.
Plans and limits
Business
100 inspections a month. It is not part of Free or Pro.
Resets on the 1st
Allowances count over the calendar month, in UTC, and reset on the 1st.
Our failures are not counted
An inspection that never started, or failed on our side, does not use the allowance.
What it does not do.
- It inspects port 443 at one address only: no other ports and no mail servers.
- Behind a content delivery network it inspects that network's edge, not your own server.
- It does not list every cipher suite the server offers, only those rated as a problem.
- It does not repeat on a schedule: you book single inspections.
- It is not a penetration test: nothing is exploited and your application's logic is not tested. We do not offer one.