TLS Version Checker

Q: Does a TLS version check replace certificate monitoring?

No. They answer different questions. The version check is about which protocols are allowed; certificate monitoring is about whether the certificate is still valid and not about to expire.

Q: Which TLS versions should I disable?

TLS 1.0 and 1.1, along with the older SSL protocols. They have known weaknesses and are disallowed by major compliance standards. Support only TLS 1.2 and 1.3 — but verify your client base first, since very old clients may not support them.

Q: Can hardening TLS break my users?

It can, for a small number of very old clients that cannot negotiate TLS 1.2 or higher. Check which protocol versions your real traffic uses before disabling older ones so you do not lock out legitimate users.

Q: Does tls version checker replace continuous monitoring?

No. It answers a question at one moment in time. For anything in production, recreate the same check in Sandglass on an interval so a later change is caught automatically.

A practical reference for teams that need to verify which TLS protocol versions a host supports.

Free TLS version checker: see which TLS protocol versions a host supports, to catch deprecated TLS 1.0/1.1 during hardening and compliance reviews.

When to reach for this tool

Reach for this when you need to verify which TLS protocol versions a host supports during setup, debugging, or an incident review. A one-off check is useful for diagnosis, but production systems need continuous monitoring once the immediate question is answered.

Legacy TLS versions are a compliance and security risk.
Hardening can break older clients, so verify before disabling.
Protocol support is separate from certificate validity.

Which TLS versions to support

TLS has evolved, and the guidance is now clear. TLS 1.2 and TLS 1.3 are the current, secure versions and are what you should support. TLS 1.0 and 1.1 are deprecated — they have known weaknesses and are disallowed by major compliance standards, so they should be disabled. SSL 2.0 and 3.0 are obsolete and insecure. The one caution when hardening: disabling old protocol versions can break very old clients that cannot negotiate TLS 1.2+, so verify your real client base before turning them off. Note that protocol version is a separate question from certificate validity — a host can support only modern TLS versions and still have an expired certificate, so keep a certificate check running alongside any protocol review.

TLS 1.3 and 1.2 — current and secure; support these.
TLS 1.1 and 1.0 — deprecated and disallowed by major standards; disable.
SSL 3.0 and 2.0 — obsolete and insecure; never enable.

From one-off check to continuous monitor

Use the TLS version result to catch outdated protocol support during hardening work, then keep monitoring certificate validity on that host continuously.

Recreate the same check in Sandglass on an interval so the next change is caught without re-running the lookup.
Send failures to email, a Slack webhook channel, or a generic webhook owned by whoever fixes the problem.
Track the result over time instead of treating one manual reading as the final answer.

Why a lookup is not monitoring

Supporting an old TLS version is a slow-moving risk, not an instant outage. Catch it during a review, but do not confuse a protocol check with ongoing availability monitoring.

Use this tool well

Step 1: Run the check and read the result

Use the output to confirm the current state, and treat anything surprising as a starting point for diagnosis rather than a verdict.

Step 2: Define what healthy means

Write down which results count as healthy, degraded, or failed before you automate anything.

Step 3: Promote it to a continuous monitor

Recreate the same check in Sandglass on an interval so the next change is caught automatically.

Step 4: Route the alert to an owner

Send failures to email, a Slack webhook channel, or a generic webhook owned by whoever will fix them.

Frequently Asked Questions

Does a TLS version check replace certificate monitoring?

Which TLS versions should I disable?

Can hardening TLS break my users?

Does tls version checker replace continuous monitoring?

Want to monitor this automatically? Start free.

Start free

Free plan, no credit card required.