Skip to main content
Security Auditor — probes which TLS protocol versions an HTTPS endpoint will complete a handshake with.

Security

TLS 1.0 and 1.1 are rejected; TLS 1.3 is the expected modern protocol.

Compatibility

TLS 1.2 without 1.3 is still accepted, but should be upgraded.
This auditor opens a TLS handshake to the audited host for each protocol Java can name (TLSv1, TLSv1.1, TLSv1.2, TLSv1.3) and records which versions complete. Certificate validity is not judged here; a trust-all handshake is used so protocol support can still be measured on expired or self-signed sites.

​
How it works

The auditor probes the HTTPS origin of the audited URL:
  1. Parse — requires an https URL with a hostname. Non-HTTPS URLs skip the handshake and warn.
  2. Probe — for each protocol, connects to {host}:{port} (default 443), sends SNI when the host is not a literal IP, and attempts a handshake with only that protocol enabled.
  3. Rules — TLS 1.0 and TLS 1.1 are separate FAILs. Completing neither TLS 1.2 nor TLS 1.3 is a FAIL. TLS 1.2 without TLS 1.3 is a WARNING (skipped when no modern TLS is present).
  4. Aggregate — ERROR (unreachable host or invalid URL) wins, then FAIL, then WARNING; if every rule passes, the audit is SUCCESS.
Java reports TLS 1.0 as TLSv1. Messages use the human labels TLS 1.0–1.3 and include the observed support map.

​
What it audits

Every row maps to one checkRule* method and one CheckCode. CheckCode suffixes use status ranges: 200 success, 300–399 warning, 400–499 fail, 500–599 error.

​
Output documentation

​
Risks and considerations

​
Deprecated protocols

  • TLS 1.0 and TLS 1.1 are deprecated (RFC 8996). Browsers and PCI environments reject them; leaving them enabled expands the attack surface (BEAST, POODLE-class downgrade).
  • A server that still completes TLS 1.0 fails even when it also offers TLS 1.2 or 1.3.

​
Modern TLS

  • TLS 1.3 (RFC 8446) removes legacy handshake modes and weak ciphers. TLS 1.2-only endpoints work for most clients today but should enable 1.3.
  • An endpoint that speaks neither 1.2 nor 1.3 cannot be used safely by current browsers.

​
Probe limits

  • The Java runtime may disable TLS 1.0/1.1 (jdk.tls.disabledAlgorithms). If the client cannot enable a protocol, that version is recorded as not offered rather than as a server FAIL.
  • This auditor does not validate certificates, cipher suites, or HSTS. Use the Certificate auditor for trust and expiry.
  • Handshake probes use a trust-all manager so protocol support is visible even when the certificate would otherwise abort the connection.