Is your SSL set up right?
Certificate, issuer, expiry, chain of trust, TLS versions and HSTS, with a clear grade and steps to fix. Checks cPanel and mail ports too.
How it works
How the SSL grade is worked out
IDX SSL Checker connects to your host over TLS, reads the certificate and its chain, checks which TLS versions are enabled and gives a grade. The grading is our own, modelled on common practice.
F
The certificate is untrusted, expired or issued for a different name, or the server offers neither TLS 1.2 nor TLS 1.3.
C and B
C means a weak key (RSA under 2048 bits). B means TLS 1.0 or 1.1 is still enabled, the chain is incomplete, or there is no forward secrecy.
A- and A
A- means everything is right except TLS 1.3 is missing. A means all checks pass.
A+
All checks pass and, on port 443, the site sends HSTS for six months or more, telling browsers to always use HTTPS.
Common questions
Which ports can I check?
443 for websites, 8443, cPanel 2083, WHM 2087 and webmail 2096, and the secure mail ports 465, 993 and 995.
What does an incomplete chain mean?
The server is not sending the intermediate certificate. Some browsers fill the gap, but phones and other software may show errors. Install the full chain your certificate authority provides.
How do I get to A+?
Disable TLS 1.0 and 1.1, enable TLS 1.3, and add an HSTS header with a max-age of at least six months.
Does IDX provide SSL certificates?
Yes. A domain-validated certificate is free on every IDX hosting plan, and OV and wildcard certificates are available too.