Free SSL/TLS scanner:
Check your encryption online for free
Enter a domain, start the scan, read the grade from A+ to F. Rated according to the methodology of the Qualys SSL Server Rating Guide – and unlike pure online tests, also for mail servers (STARTTLS) and services on non-standard ports.
Free of charge, free to use, no account and no installation.
Grades from A+ to F
Mail servers too (STARTTLS)
Free to use
No account, no setup
You can't see an outdated TLS configuration from the outside
But it may well be there: most poor grades come from configurations that were right years ago and that nobody has touched since.
What is Gossling?
Gossling is the free SSL/TLS scanner by CheckFix. Right in your browser at gossling.checkfix.io, it checks how securely a server encrypts and assigns an overall grade from A+ to F based on the weighting of the Qualys SSL Server Rating Guide.
Gossling was born out of practice: during a Security-Check, the TLS test of a customer system crashed reproducibly, and none of the available tools delivered a result. Three weeks later, our own scanner was ready.
Unlike pure online tests, Gossling also reaches mail servers via STARTTLS (smtp://, imap://) and – when self-hosted via Docker – internal hosts. And it may also be used on behalf of clients.
✓ Free ✓ Commercial use allowed ✓ No account ✓ No installation
What Gossling checks
Enter a target – a domain, an HTTPS service on any port or a STARTTLS mail server – and the results come in live.
Protocols
SSLv2/3 and TLS 1.0 to 1.3, including downgrade and consistency checks.
Cipher suites
Enumeration per version, strength overview and server preference.
Certificates
Chain validation, CT/SCT, OCSP stapling, Must-Staple, CAA and revocation.
Trust stores
Mozilla, Apple, Android, Java and Windows.
Vulnerabilities
Heartbleed, POODLE, ROBOT, DROWN, BEAST, CRIME, FREAK, Logjam, Sweet32, Ticketbleed, BREACH and more.
HTTP headers
HSTS including preload eligibility, CSP, cookies and WAF fingerprint.
What the A+ to F grade means
The rating follows the Qualys methodology. Three areas are weighted into the grade.
On top of that comes the capping logic of testssl.sh: a single severe finding pulls the grade down – Heartbleed means F, enabled TLS 1.0 caps the grade at B. With multiple endpoints, the worst one counts. Your encryption is only ever as strong as the weakest method your server still accepts.
Why Gossling?
Gossling rates according to the same methodology as SSL Labs – so the grade speaks the same language that counts in an audit. The difference: Gossling also checks mail servers (STARTTLS) and services on non-standard ports, can be automated via API and is free to use.
You’ll find the detailed comparison with SSL Labs, testssl.sh and other tools on our blog: Free SSL Labs Alternative: 8 Tools Compared.
From scan to fix
A scanner tells you what's wrong. The more practical question is: what do you do about it now?
Gossling covers TLS/SSL. The free CheckFix Security-Check checks your entire external attack surface in one run – mail security (SPF, DKIM, DMARC), TLS/SSL, known vulnerabilities (CVE matching), security headers and internet-facing interfaces – with an A-to-F rating per category. If you want a structured to-do list and want the other check categories tested as well, start with the free Security-Check and decide on next steps at your own pace.
Frequently asked questions
Is there a free SSL Labs alternative?
Yes. Gossling runs in the browser at gossling.checkfix.io, costs nothing, assigns an overall grade from A+ to F and may also be used commercially. No download, no account, no third-party queue.
Which free SSL Labs alternative can I use commercially?
Gossling. The tool runs online, assigns an A+ to F grade based on the weighting of the Qualys SSL Server Rating Guide and may be used on behalf of clients – with no monthly test limit. With Qualys SSL Labs, the API is not approved for commercial use without permission, and automated scraping of the website is prohibited.
How can I test my SSL/TLS encryption online for free?
Enter your domain at gossling.checkfix.io, start the scan, read the overall grade from A+ to F. The test runs in the browser, without installation and without an account. It checks protocols (SSLv3, TLS 1.0 to 1.3), cipher suites, certificates including chain and validity, and known TLS vulnerabilities; mail servers via smtp:// or imap:// as well.
What does the warning “SSL obsolete version” mean?
It means a server accepts outdated encryption that is considered insecure – usually SSLv3, TLS 1.0/1.1 or weak algorithms such as RC4, 3DES or SHA-1. Only TLS 1.2 and 1.3 are current and secure. The fix: disable old protocols on the server and allow only TLS 1.2/1.3 with strong cipher suites.
Can I test my mail server too?
Yes. Your mail server also establishes TLS connections via STARTTLS. With Gossling, you check smtp:// and imap:// directly, just like HTTPS services on non-standard ports. SSL Labs only checks publicly accessible web servers.
What doesn’t a TLS test show?
A good TLS grade is one checkpoint, not a security clearance. It says nothing about known vulnerabilities (CVE), SPF/DMARC, open ports or security headers. The free CheckFix Security-Check gives you the full picture across five categories.