Security Tools

SSL Handshake Tester — Live TLS Certificate & Grade

Live TLS handshake read — certificate, protocol, cipher, and grade via ssl-grade

How to Use This Tool

  1. Enter a hostname (example.com) — http:// and https:// prefixes strip automatically.
  2. Our server connects to port 443 with SNI matching your host.
  3. TLS handshake completes and leaf certificate metadata is read.
  4. issuer, subject, subjectAltNames, serialNumber, and fingerprint256 populate.
  5. grade assigns A through F from validity, protocol version, and daysRemaining.
  6. Review protocol, cipher, and cipherInfo note about grading scope.

About This Tool

SSL handshake testing verifies that a server completes TLS negotiation correctly — certificate presentation, protocol version, cipher suite selection, and SNI behavior on port 443. VSPIC ssl-handshake-tester calls the ssl-grade action with your host input — opening a TLS connection with Server Name Indication, reading the leaf certificate and negotiated protocol, and returning issuer, subject, subjectAltNames, validFrom, validTo, daysRemaining, protocol, cipher, fingerprint256, grade, and cipherInfo — identical backend to ssl-tls-grade-checker and ssl-chain-checker.

Results confirm handshake completion from our server vantage point — not full cipher suite enumeration, intermediate chain path validation, or mutual TLS client certificate testing. For PEM chain inspection from files, use certificate decoder. Pair with ssl-expiry-checker when renewal monitoring is the primary goal.

Common use cases

  • Check if a VPN or proxy is detected on your connection
  • Validate SSL certificates before launch
  • Scan for email addresses in known breaches

Why use VSPIC for ?

  • Live handshake verification without uploading PEM files.
  • subjectAltNames lists hostname coverage for SNI validation.
  • grade and protocol surface misconfiguration quickly.
  • fingerprint256 for inventory matching and renewal tickets.
  • Same ssl-grade JSON as ssl-tls-grade-checker for automation.
  • Free instant TLS probe on public hostnames.

SSL handshake testing scope

Handshake testing confirms ClientHello through Finished messages succeed, certificate matches SNI, and negotiated protocol meets policy. ssl-grade performs live connection, reads leaf cert and negotiated parameters, assigns letter grade from validity and TLS version.

Full handshake capture with packet detail requires Wireshark — our tool returns metadata summary, not frame hex dumps.

Reading grade, protocol, and cipher

Grade A prefers valid certificate, TLS 1.3, comfortable expiry. TLS 1.2 incurs minor penalty. TLS 1.0 and 1.1 incur large penalties. Expired certificates fail to F.

cipher shows negotiated suite name — informational, not full offered list from server.

Relationship to ssl-tls-grade-checker

ssl-handshake-tester, ssl-tls-grade-checker, and ssl-chain-checker all call action ssl-grade with identical JSON. ssl-tls-grade-checker is canonical TLS grading SEO; this page emphasizes handshake testing vocabulary.

API GET /ip-tools/api/extended?action=ssl-grade&host=example.com

CDN and shared hosting caveats

Enter customer-facing hostname. Cloudflare or load balancer edges may present edge certificates differing from origin — test the name browsers use.

Handshake failures versus grade penalties

Connection timeout or TLS alert failure may return error JSON rather than grade — distinguish unreachable hosts from weak cipher policy.

Retry from different networks if geo-blocking suspected.

Renewal workflows

After reissue, rerun to confirm new serialNumber and extended validTo. subjectAltNames should include required hostnames before closing change tickets.

Authorized probing

Probe hostnames you own or may test per policy. Avoid hammering third-party hosts.

Important notes & limitations

  • Port 443 only — non-standard HTTPS ports not probed.
  • Single connection from our server — CDN edges may differ geographically.
  • Does not test mutual TLS or client certificate requirements.
  • Not full SSL Labs cipher enumeration or chain path audit.
  • rejectUnauthorized false reads cert even when chain untrusted — check valid flag.

Frequently Asked Questions

Yes. VSPIC offers this SSL handshake tester at no cost with no account required. Results load in real time.

We do not permanently store your queries on our servers. Some tools run entirely in your browser; others fetch public data for the request only.

Yes. Open the page in any modern phone or tablet browser. Results work on Wi‑Fi and mobile data.

No. ssl-grade reads certificate and negotiated protocol from completed handshake — not PCAP frames.

Yes. action ssl-grade with host parameter — identical JSON.

No. Server-side handshake with SNI only — no client certificate upload.

Browsers validate full chain trust. We read leaf with rejectUnauthorized disabled for metadata.

No. ssl-grade probes port 443 only on this action.

ssl-grade with the host parameter.

Next step for your check

Continue with ssl/tls grade checker on VSPIC.

SSL/TLS Grade Checker

Trusted by Users Who Value Privacy

Always Free

No premium plan ever

100% Private

Files processed in browser

Instant Results

Convert in seconds

Works Everywhere

Any device, any OS