Domain SSL/TLS Security Configuration Checklist
A 20-item manual SSL/TLS security self-audit checklist across certificates, protocols, cipher suites, HTTP security headers, and DNS security — each item ships with a suggested command; generates a graded report, but never scans your domain automatically.
FreeOnline Tool
Loading…
How to Use
- Expand the five categories — Certificate, Protocol Support, Cipher Suites, HTTP Security Headers, DNS Security — to see all 20 checklist items, each with a recommended configuration and a suggested detection command (openssl, curl, dig, nmap, etc.).
- Copy each item's command into your own terminal, run it against your target domain, and judge for yourself whether it passes.
- Click the circle to the left of an item to mark it "passed" (turns green). As you check off items, the progress bar and stat cards at the top update in real time.
- Once done, click "Generate Report" to produce a Markdown report with an overall grade (A/B/C/D), per-category pass rates, and a prioritized remediation list.
- Click "Load Sample Data" to pre-fill a sample set of checked items and preview the report; click "Reset" to clear all checks and start over.
Features
- Covers 20 SSL/TLS checks across Certificate (5), Protocol Support (4), Cipher Suites (3), HTTP Security Headers (5), and DNS Security (3), each with a recommended config and a matching detection command.
- A purely manual self-audit checklist — you run the detection commands yourself and judge the results; the tool never connects to your domain or reads results automatically.
- Live progress bar and "passed / pending" stat cards that update as you check items off.
- One-click Markdown report generation, including an overall grade (A excellent / B good / C fair / D failing), a per-category pass-rate breakdown, and a prioritized fix list.
- Includes a built-in TLS version comparison table (release year, security rating, browser support, and recommendation for TLS 1.0/1.1/1.2/1.3).
Use Cases
Pre-launch SSL/TLS configuration audit
Before a site goes live, an ops engineer runs each of the 20 detection commands to confirm the certificate chain, protocol versions, cipher suites, and security headers all meet best practice before checking them off.
Producing a written report for a security audit
A security engineer performs the manual checks, checks off the items, and generates a graded Markdown report in one click to use directly as an audit deliverable or email attachment.
Internal SSL configuration training
A tech lead uses the checklist to walk new hires through the full scope of SSL/TLS hardening, demonstrating the matching detection command live for each item.
Periodic regression checks on live configuration
The same checklist is re-run quarterly against production domains, comparing pass rates and grades across reports to catch configuration that regressed back to an insecure state.
FAQ
Does this tool automatically scan my domain?
No. All 20 checks require you to copy the matching command (openssl/curl/dig/nmap, etc.) into your own terminal and run it yourself, then manually mark the item as passed based on the result. The tool never connects to your domain — it only organizes the checklist, tracks your checked state, and generates the report.
How is the grade calculated?
The grade is based on how many of the 20 items are checked: 18+ is A (excellent), 14+ is B (good), 10+ is C (fair), and below 10 is D (failing). This is a simple built-in scoring rule for reference only — it is not any official security certification.
Are my checked items saved?
No, not across sessions. Checked state only lives in the current page's memory and is lost on refresh or tab close. Save or copy your report after generating it if you need to keep the results.
Can I use this without server access?
Yes — the checks that target publicly reachable behavior (openssl s_client, curl -I, dig) work against any domain you can reach, no server access required. But acting on remediation suggestions (e.g. Nginx config examples) requires access to modify the target server.
Do the listed commands require extra tools?
openssl, curl, and dig/host are typically preinstalled on Linux/macOS or available via a package manager. The nmap ssl-enum-ciphers script requires nmap to be installed separately (nmap --script ssl-enum-ciphers).