All guides
← All guides

TLS & certificate assessment

Running services
On this page

In plain terms

The padlock in the browser means traffic to your site is encrypted with TLS (Transport Layer Security, the successor to SSL, or Secure Sockets Layer). But "has TLS" and "has good TLS" are different things. TLS assessment checks the quality of that encryption: which protocol versions and cipher suites you accept, whether your certificate is valid and current, and whether your configuration has known weaknesses.

Why it matters

A misconfigured TLS setup quietly undermines the protection users assume they have: supporting an ancient protocol (SSLv3, TLS 1.0) or a weak cipher leaves connections open to downgrade and interception attacks. And the most common TLS failure is mundane, a certificate that expired, which takes the whole service down and erodes trust. These issues are invisible until someone (or an outage) finds them.

Where it fits

  • Artifact: a running TLS endpoint (HTTPS site, API, or any TLS service).
  • Stage: against deployed environments and on a schedule, certificate expiry especially needs continuous monitoring, not a one-time check.

How it works

A TLS scanner opens connections to your endpoint and negotiates deliberately, enumerating which protocol versions and cipher suites the server accepts, inspecting the certificate chain (validity dates, trust, key strength, hostname match), and flagging known issues (weak ciphers, missing forward secrecy, vulnerable configurations). It pairs naturally with the HSTS header, which tells browsers to insist on HTTPS.

The connection a user makes ends before your origin does A browser opens a TLS connection that terminates at a content delivery network or load balancer. That edge holds the certificate a user's browser validates and chooses the protocol versions and cipher suites it will accept. Behind it, a second connection carries the request on to the origin server, with its own certificate and its own settings, which no browser ever negotiates. Assessing the origin grades a connection nobody outside your network makes. WHERE THE CONNECTION ACTUALLY TERMINATES a browser validates one certificate TLS the CDN or load balancer holds the certificate and picks the ciphers a second hop your origin its own settings entirely this is the configuration every user meets Assess whichever endpoint terminates the connection you care about. Scanning the origin when the edge terminates TLS grades a handshake nobody outside your network ever performs. The expiry that takes a service down is usually the edge's, and the certificate nobody automated is usually the origin's.
Both hops are worth assessing and they are two different questions. Only one of them is the padlock a user is looking at.

Popular & reputable tools

ToolNotes
testssl.shOSS; thorough command-line TLS/cipher/cert checker
SSL Labs / ssllabs-scanQualys' well-known grading service + CLI
sslyzeOSS, fast, scriptable TLS scanner
Certificate monitoring (various)Track expiry across your estate

Common pitfalls

  • Certificate expiry is the #1 real-world failure. Automate renewal (ACME/Let's Encrypt) and monitor it, don't rely on a calendar reminder.
  • Legacy compatibility vs. security. Supporting old clients can mean keeping weak protocols; know the trade-off you're making.
  • Edge-terminated TLS. If a CDN/load balancer terminates TLS, assess that endpoint, it owns the configuration, not your origin.
How Draugr fits. The tls control assesses each of a component's hosts: with a native probe, reporting certificate expiry, trust and hostname validity, weak keys or SHA-1 signatures, and deprecated TLS 1.0 and 1.1, normalized to SARIF like every other control. Nothing to install and seconds per host, which is what makes it a check you can put on every release rather than an audit you schedule. Set expiryWarnDays and expiryErrorDays to decide how much notice you want on the failure the page calls the most common one; both are in the Saga reference.

What a per-release check deliberately does not do is enumerate the protocol surface. SSLv2 and SSLv3, export and NULL cipher suites, and vulnerability probes like ROBOT and Heartbleed belong to a deep-audit tool run occasionally against a host you already know terminates the connection. The headers control covers HSTS, TLS's browser-facing companion.

Keep learning