Truvo Free Tools

SSL and TLS checker

TLS is what keeps traffic between your visitors and your site private, and browsers now warn people away from sites that get it wrong. This checker tests whether HTTPS answers, whether plain HTTP redirects to it, and how strong your HSTS policy is, and names the SOC 2 and ISO 27001 controls each answer affects.

SOC 2 CC6.1SOC 2 CC6.7ISO 27001 A.8.24ISO 27001 A.5.33
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure. These tools come out of that work.

Connect on LinkedIn

How the SSL and TLS checker works

The check is passive: it opens one normal HTTPS connection and one plain HTTP request to your domain, the same requests any browser makes, and reads the responses.

01

Query

You enter a domain. The tool opens a TLS connection to it, then separately requests the plain HTTP version to see whether it redirects to HTTPS or serves content directly. No other traffic is sent.

02

Read

The result shows whether HTTPS is reachable, whether HTTP redirects, and the Strict-Transport-Security header: its max-age (at least 180 days, ideally a year), includeSubDomains and preload.

03

Map

Each finding names the controls it speaks to: SOC 2 CC6.1 and CC6.7, and ISO 27001:2022 A.8.24 (use of cryptography) and A.5.33 (protection of records). Working HTTPS with a redirect and a long HSTS policy is evidence; a missing redirect or HSTS is a gap to close.

Found a gap? We fix it for you.

Truvo's security engineers harden TLS, headers and DNS, and hand you the evidence an auditor asks for. Tell us the domain and we will scope the fix.

Contact us

  • HTTPS everywhere

  • HTTP to HTTPS redirect

  • HSTS with preload

  • Certificate management

  • Audit evidence

  • Fixed-price scope

SSL checker: frequently asked questions

This one tests three things: whether your domain answers over HTTPS with a valid TLS connection, whether the plain HTTP version redirects to HTTPS, and whether you send an HSTS header and how long it lasts. Certificate details such as expiry are visible in the connection but the grade is about reachability, redirect and HSTS.

Truvo maps HTTPS and HSTS findings to SOC 2 CC6.1 and CC6.7, and to ISO 27001:2022 Annex A controls A.8.24 (use of cryptography) and A.5.33 (protection of records). The mapping is advisory: it shows which control a finding gives evidence for or signals a gap against. It is not a substitute for an audit.

Yes. The tool makes one HTTPS request and one HTTP request to your domain, the same thing a browser does on a first visit. Nothing is written or changed and no other endpoint is touched.

HTTP Strict Transport Security tells browsers to never speak plain HTTP to your domain again for as long as max-age says. Without it, the very first connection, before any redirect, can be intercepted and stripped of encryption on a hostile network such as public Wi-Fi. A max-age of a year with includeSubDomains, submitted to the browser preload list, protects even first visits.

A valid certificate covers only the HTTPS connection. If plain HTTP answers without redirecting, or HSTS is missing or short, a visitor can still be served or downgraded to unencrypted pages. The fix is a 301 redirect from HTTP to HTTPS at your server or CDN and a Strict-Transport-Security header with a long max-age.