Website Security
SSL/TLS Audit
Completes a TLS handshake and audits the certificate, protocol versions, cipher strength, and HSTS against 20 checks.
What is SSL/TLS Audit?
SSL/TLS is the encryption behind the padlock in the browser — it protects everything between your users and your server from being read or tampered with in transit. But "has HTTPS" isn't the same as "configured well." A TLS setup can still offer outdated protocols, weak ciphers, or a certificate that's expired, mismatched, or about to lapse. An SSL/TLS audit checks not just that encryption exists, but that it's strong and correctly configured.
What Nandix checks
- Certificate validity — expired, self-signed, hostname mismatch, expiring within 30/90 days, weak signature algorithm, incomplete chain, weak key size, lesser-known CA
- Protocol support — SSLv3 / TLS 1.0 / TLS 1.1 offered, TLS 1.3 unsupported, legacy ciphers
- HSTS — missing, short max-age, no includeSubDomains, no preload
- OCSP stapling and Certificate Transparency presence
Probes
20 checks
How it detects
Passive. Nandix opens a TLS connection to gather facts — the presented certificate, the negotiated protocol and cipher, per-version protocol support, the HSTS header, and OCSP/CT signals — then compares them to the probe set. A port with no TLS is reported as a critical finding rather than an error. No traffic beyond the handshake is exchanged.
Why it's dangerous
Weak TLS undermines the one thing users trust HTTPS to guarantee. Outdated protocols like TLS 1.0/1.1 and legacy ciphers are vulnerable to known downgrade and decryption attacks, letting a network attacker read or alter "encrypted" traffic. An expired or mismatched certificate throws browser warnings that erode trust and train users to click through danger. And a certificate that quietly expires takes your whole site offline — one of the most common and avoidable outages there is.
Example finding
The server still negotiates TLS 1.0, a deprecated protocol with known weaknesses — a network attacker may force a downgrade.
How to fix it
Modernize and monitor your TLS configuration. Disable SSLv3, TLS 1.0, and TLS 1.1 — serve only TLS 1.2 and 1.3. Use strong cipher suites — prefer forward-secrecy (ECDHE) suites; drop RC4, 3DES, and export-grade ciphers. Automate certificate renewal (e.g. ACME/Let's Encrypt) so a cert can never silently expire, and monitor expiry dates. Enable HSTS with a long max-age and includeSubDomains to lock in HTTPS.
nginx
# nginx — modern TLS
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;Severities & standards
Severities
CRITICAL · HIGH · MEDIUM · LOW
References
Frequently asked questions
My site has a valid certificate — do I still need a TLS audit?
Yes. A valid cert says nothing about which protocols and ciphers you accept. Many sites with green padlocks still allow weak legacy protocols an attacker can exploit.
How long before expiry should I worry about a certificate?
Renew well before the deadline — 30 days is a common alert threshold. With automated renewal it's a non-issue; without it, expiry is a leading cause of surprise outages.
Is TLS 1.2 still safe, or do I need 1.3?
TLS 1.2 remains secure when configured with strong ciphers. TLS 1.3 is faster and simpler and should be enabled too — but you don't have to drop 1.2 yet.
See how every check runs on the methodology page, or browse all scanners.
Scan your site for this →Free SSL/TLS checker. Nandix audits your certificate validity, protocol versions, cipher strength, and HSTS across 20 checks — catch expiring certs and weak legacy protocols before users do.