SSL Toolkit Logo
Tools Features Compare FAQ Login

SSL/TLS Protocol Feature Matrix

Detailed breakdown of supported SSL/TLS features and extensions

Protocol Features

About TLS Protocol Features Explorer

Comprehensive catalog of TLS protocol features, extensions, and capabilities across different versions. Shows which features are supported and their security implications.

How to Use

  1. 1Enter domain
  2. 2Click Explore Features
  3. 3Review supported features

Use Cases

Frequently Asked Questions

Cipher suites, protocol versions, key exchange methods, and the TLS extensions a server supports, including SNI, ALPN and OCSP stapling. Each of those changes what a client can negotiate, and several of them are the difference between a configuration that looks modern and one that behaves modern: a server can offer TLS 1.3 and still omit the extensions that let clients use it efficiently. Tracking them together shows what is actually available rather than what a version number implies.
Some extensions like SNI and ALPN improve functionality, while others like OCSP stapling enhance performance. Certain extensions may also have security implications depending on how they are configured.
Enable modern features like TLS 1.3, ALPN, and OCSP stapling. Disable legacy features like SSLv3, RC4, and weak ciphers. The tool helps you identify which features are currently enabled and their security status.
Because each of the three is read from a live handshake and the rest would be decoration. A feature matrix that marks session tickets as supported without attempting a resumption, or OCSP stapling without fetching a response, is reporting what it assumes rather than what it found. Three measured findings beat a long list of assumed ones, and the score stays meaningful because every point in it was earned by the connection.
Because the probe reports what was negotiated with it, not what your server is configured for. A middlebox, a CDN edge node with older settings, or a fallback triggered by the offered parameters can all downgrade one particular connection while other clients still get 1.3. That gap is the useful result: it tells you the downgrade happens on the path, and re-running the check bypassing the CDN usually confirms where.
HTTP/2 negotiation on that connection. When the server selects no application protocol, the client falls back to HTTP/1.1, which still works but loses multiplexing and header compression. Most visitors will not notice on a small page, but on asset-heavy pages the difference is measurable. The fix is server-side — enabling h2 in the web server or proxy — and re-running this probe is the fastest way to confirm it took effect.
That the routing worked, not just that a certificate exists. A plain certificate check confirms the server presented something valid; the SNI finding confirms it presented the certificate for the hostname you asked about. On shared hosting and behind SNI-based routing, those are different statements, and a mismatch here explains the wrong-certificate errors that a validity check alone would call fine.
Yes, and that is one of its better uses. Run the same hostname against staging and production, or before and after a configuration change, and the three findings plus the score give you a compact diff. Because each finding is binary and measured the same way every time, a change from 100 to 66 across a deploy points at exactly the feature that regressed without any further digging.

What the Probe Measures

This page opens a real TLS connection and reports only what that handshake reveals. Three features are probed, and each one is read from the live connection rather than assumed — if the handshake cannot demonstrate a feature, it is reported as absent.

  1. 1Negotiate TLS and read the version. If the server and this probe agree on TLS 1.3, the first feature passes. Anything older fails it, which is usually the correct outcome for a public site.
  2. 2Offer HTTP/2 and HTTP/1.1, then check what the server picked. ALPN counts only when the server actually selects a protocol during the handshake, not when it merely accepts the connection.
  3. 3Read the certificate the server returned for your hostname and confirm it matches. SNI passes when the server proves it routed your name to the right certificate, which is the observable part of SNI working.

The score is the share of the three that passed, so 100 means all three held and 66 means one failed. Two things are deliberately not listed — session resumption and OCSP stapling — because this probe does not perform the exchanges that would demonstrate them, and a finding the code never measures would not be a finding.

Tips & Best Practices

Technical Details

Features: Session resumption, renegotiation, SNI, ALPN, and extensions
Support: Feature support detection and analysis
Security: Feature security implications and recommendations
Output: Protocol feature support matrix with assessment

Related Tools

Protocol Analyzer TLS Extensions Protocol Matrix Emerging Protocols TLS Version Checker