Your files stay on your device TLS cipher suite analyzer Grade a TLS handshake you ran yourself: paste openssl output and get forward-secrecy, AEAD, deprecated-version, and key-strength verdicts. Paste a handshake transcript to grade it Run one of the s_client commands below against your server, paste what it prints, and the grading runs here in the tab. - openssl sclient -connect example.com:443 -tls13 &1 | head -40Copy - openssl sclient -connect example.com:443 -cipher 'AES128-SHA' -tls12 &1 | head -40Copy The first two lines show what the server picks when it is allowed its best. The -tls1_1 line and the forced -cipher line answer the harder question: what else the server still accepts. A handshake that fails with "no peer certificate available" or an alert means the server refused that version or suite, which is the result you want. This page cannot open TLS handshakes: browsers give a page no socket API that can pin protocol versions or cipher lists, so nothing is probed from here. You run openssl on your own machine, the page grades the transcript. Grading follows the Mozilla Server Side TLS thresholds and the RFC 8996 deprecations: TLS 1.0 and 1.1 are deprecated, SSL is a critical finding, static RSA key exchange forfeits forward secrecy, and SHA-1 or MD5 certificate signatures are treated as critical. A grade covers one handshake, not the whole server: a server that still accepts TLS 1.0 on a second port will not show it in a 1.2-plus transcript. Options More network tools - Certificate & CSR (/web/certificate) - HTTP timing probe (/network/http-timing) All network tools (/network) Was this tool useful? YesNo Canonical HTML: https://nutter.tools/network/tls-cipher-suite-analyzer Markdown version: https://nutter.tools/network/tls-cipher-suite-analyzer.md Plain-text version: https://nutter.tools/network/tls-cipher-suite-analyzer.txt Agent index: https://nutter.tools/llms.txt