Question 1

What does the SSL Scanner test?

Accepted Answer

It runs a full TLS posture audit against any reachable HTTPS or STARTTLS (mail) endpoint: which protocol versions are enabled (SSLv3 through TLS 1.3), the negotiated and accepted cipher suites, forward secrecy, the certificate's trust, hostname match, expiry and chain, HSTS and HTTP security headers, and it maps a detected OpenSSL or web-server version to known CVEs. It finishes with an SSL Labs-style letter grade.

Question 2

What do the grades mean?

Accepted Answer

Grades run A+ (strong, modern config with HSTS) down through A, B, C, and F, following the SSL Labs convention of hard caps for weak protocols and ciphers. A separate grade T means trust could not be established — an untrusted chain, hostname mismatch, expired or self-signed certificate — and overrides the letter until trust is fixed.

Question 3

Why does it say "undetermined" instead of pass or fail?

Accepted Answer

Because the machine running the test has its own TLS stack. If its OpenSSL or LibreSSL can't offer a given protocol or cipher, the scanner genuinely doesn't know whether the server would accept it — so it reports that rung as undetermined rather than pretending the server refused it. Undetermined items never help or hurt the grade; they're listed as coverage gaps so results are reproducible across machines.

Question 4

What's the difference between Coverage and Warnings?

Accepted Answer

Warnings are findings about the server — weak protocols, missing forward secrecy, an absent HSTS header. Coverage notes are the opposite: things the client running the test couldn't check, such as a legacy cipher its OpenSSL refused to offer. Keeping them apart means a clean server is never buried in noise caused by the testing client's limitations, and coverage gaps don't affect the grade.

Question 5

Does it work on mail servers and other STARTTLS services?

Accepted Answer

Yes. STARTTLS is auto-detected from common ports (25/587 SMTP, 143 IMAP, 110 POP3) or you can select the mode explicitly, so you can grade the TLS on SMTP, IMAP, and POP3 endpoints the same way as HTTPS.

Question 6

Is it safe to run against my server?

Accepted Answer

The default scan is passive and read-only: it performs ordinary TLS handshakes and reads the certificate and headers. Active exploit-style probes (Heartbleed, CCS injection, Ticketbleed, ROBOT) are opt-in and only run after you confirm you're authorized to test the target. The scanner also refuses private, loopback, and internal addresses.

Question 7

Is it free?

Accepted Answer

Yes — free, no account required. It's built by CloudFloorDNS, the managed-DNS provider behind dnsscanner.net.