SSL Tools

TLS Version Checker

Check which TLS version and signature algorithm a website's server supports.

Enter a domain to check which TLS version its server negotiates.

More SSL Tools

View all 3

SSL Expiry Checker SSL Certificate Checker

Outdated TLS versions can hurt security and compliance - JustChecker keeps track of this for you automatically.

What Is the TLS Version Checker?

TLS (Transport Layer Security) encrypts the connection between a browser and a website. This tool shows which TLS version a server negotiates and the certificate's signature algorithm, so you can confirm the site uses modern, secure settings.

When to Use It

During security or compliance reviews (for example PCI DSS requires TLS 1.2 or newer).
After changing web server or load balancer configuration.
When older clients report connection errors.

How to Use It

Enter a domain and run the check.
Look at the negotiated TLS version and the signature algorithm.

Understanding the Result

TLS 1.3 and TLS 1.2 are current and secure. TLS 1.0 and 1.1 are deprecated and blocked by modern browsers. A signature algorithm such as sha256WithRSAEncryption or ECDSA with SHA-256 is expected; SHA-1 signatures are no longer trusted.

Limitations

The result shows the version negotiated with our checker, which normally is the highest version both sides support. It is not a full scan of every protocol and cipher suite the server allows. Check certificate validity with the SSL Certificate Checker.

Frequently Asked Questions

It attempts to negotiate a connection using each TLS protocol version from legacy TLS 1.0/1.1 up through modern TLS 1.2 and 1.3, reporting exactly which ones your server is willing to accept.

Both have known cryptographic weaknesses and have been formally deprecated by major browser vendors and the IETF - PCI-DSS compliance for payment processing explicitly requires disabling them.

Supporting an old protocol version doesn't automatically mean active exploitation, but any client still using outdated software could be at risk. The standard practice is disabling TLS 1.0/1.1 entirely so only modern versions are negotiated.

TLS 1.3 removes outdated cryptographic options still permitted under 1.2 and reduces handshake round trips, improving both security and speed - but a correctly configured TLS 1.2 server with modern cipher suites is still considered secure.

Supporting a small range of modern versions (e.g. both 1.2 and 1.3) is normal, balancing compatibility with security. Supporting the full historical range including 1.0/1.1 is the actual concern this tool flags.

This is configured at the web server level (Apache, Nginx, IIS, or your load balancer/CDN), not via DNS or your certificate - consult your server software's SSL/TLS protocol configuration.

It can affect an extremely small, shrinking population of very old, never-updated browsers - for the overwhelming majority of modern traffic, disabling legacy protocols has no visible effect.