A padlock in the address bar means one thing: the connection is encrypted. It does not mean the certificate is trusted by every client, that obsolete protocols are switched off, or that the server is not answering in ways it should have stopped answering a decade ago.
The TLS check costs one credit and needs no proof of ownership, because everything it reads is something the server publishes to anyone who connects.
The certificate itself
Expiry is the obvious one, and still the most common outage nobody planned for. Certificates now last months rather than years, and renewal is the sort of task that works until the person who set up the cron job leaves.
Beyond the date: the trust chain (does it actually terminate at a root the client trusts, or is an intermediate missing?), the key type and size, certificate transparency — whether the certificate was logged publicly, which is what lets you discover certificates issued for your domain that you did not ask for — and CAA, the DNS record that tells certificate authorities which of them may issue for your name at all.
What the server will agree to
A certificate can be perfect while the server negotiates a connection nobody should accept.
The check records the highest TLS version offered, whether TLS 1.2 and 1.3 are available, and whether TLS 1.0, 1.1 and SSL 3.0 are still accepted. It looks at cipher suites and forward secrecy — whether traffic captured today stays unreadable if the server's key is stolen next year. It checks HSTS, which tells browsers never to try the unencrypted version again, and OCSP stapling, where the server presents its own proof of non-revocation instead of making the browser go ask.
Named weaknesses, probed rather than guessed
Heartbleed, POODLE, ROBOT, DROWN, Logjam, CRIME, Ticketbleed, CCS injection, insecure renegotiation, CBC padding oracles. Each is tested individually.
That distinction matters more than it sounds. A tool can infer "you accept TLS 1.0, therefore you are probably vulnerable to BEAST" — and be wrong, because the server may not accept the cipher the attack needs. ClickScan asks.
And when a check genuinely could not be run, the report says "not tested" rather than quietly leaving it out. A list showing only what was looked at reads as an all-clear, which is the most expensive kind of misleading.
What you get
A grade from A+ to F, the finding that drove it, and what to change. Expiry alerts arrive at 30, 7 and 1 days — and on lapse, if it gets that far.
Run it free: every new account gets starter credits, and this check costs one. Start at app.clickscan.ai, or see everything ClickScan checks.