SSLBoard - Frequently Asked Questions

SSLBoard scans a domain's public endpoints and reports on its TLS health. Paste in a domain and you get a scored breakdown: certificates, protocol versions, cipher suites, forward secrecy, key strength, HSTS, and post-quantum readiness. No account, no subscription.

No. Scanning a domain is free and needs no account, no email and no payment details. You get the score and a summary of the findings right away. You only pay if you want the full report with every affected host, and Stripe asks for your email at checkout so we can send you a copy.

SSLBoard is pay-per-use. Every scan is free and shows the score and a summary of the findings. You pay once when you want the details: the full report with every affected host, IP:port, certificate and export.

Full report pricing:
- 10 endpoints or fewer: $5
- More than 10 endpoints: $20

Every purchase includes 30 days of free retests, so you can rescan after each fix at no extra cost. A report older than 24 hours is stale: its details come with a fresh scan at the same price and with the same 30 days of retests.

You see the exact price before you pay. No hidden fees, no subscriptions, no automatic renewals.

The summary report: your score, the executive summary, the key findings with their severity, how many hosts and endpoints each issue affects, one example per finding, and the adjacent domains we discovered. The full report adds every affected hostname and IP:port, the certificate inventory, per-endpoint TLS version breakdowns, weak cipher details, forward secrecy gaps, key strength analysis, HSTS and redirect status, connection errors, post-quantum readiness, DNSSEC details, and the Markdown, CSV and JSON exports.

The report covers deployed certificates and CAA policies, TLS versions and OCSP stapling, flagged cipher suites, forward secrecy, key profiles, HTTP redirects, HSTS and other browser security headers, connection errors, post-quantum readiness, DNSSEC, email security, and adjacent domains. Available sections depend on the evidence collected. Our documentation explains the checks, possible results, and next actions.

SSLBoard uses names from public certificate discovery data to find hosts within your domain, then makes live connections to inspect their deployment. DNS, web-response, and mail-security checks supply additional evidence. It is an assessment of discovered public endpoints, not a guarantee of complete coverage of every hostname and port. Read how SSLBoard gets its data and coverage limits.

No. We scan your public endpoints from the outside, the same way an attacker or auditor would. Nothing to install, no firewall rules to change, no credentials to share.

It depends on how many endpoints we find. A domain with 400 endpoints takes about 90 seconds. Most domains are smaller than that, so under a minute is typical. You can watch it run, and the report link appears as soon as the scan finishes.

Yes, with a caveat. The report covers your SSL/TLS inventory, certificate verification, weak cipher identification, deprecated TLS version usage, and revocation status. All things PCI DSS cares about under its strong cryptography requirements. You can export the data or share the report link with your QSA or auditor as supporting evidence. See our compliance page for a breakdown of how SSLBoard maps to specific frameworks.

That said, SSLBoard is not a certified auditing tool. It doesn't constitute formal compliance assessment or certification under PCI DSS, GDPR, HIPAA, NIS2, SOC 2, or any other framework. Getting certified is still your job.

The score runs from 0 to 100: Good at 80 or above, Fair at 60–79, Poor at 40–59, and Critical below 40. It combines Certificate Health (30%), Protocols (15%), Ciphers (15%), Confidentiality and Agility (20%), Web Hardening (10%), Reliability (5%), and Future Readiness (5%). Penalties depend on the issue and affected population; not every displayed finding contributes to the score. Always review unavailable checks and connection errors alongside the number. See how the TLS score works.

Yes. Every paid report includes 30 days of free retests: open your report from the link we emailed you and choose Run it now. After 30 days, a fresh scan costs the same as a full report and starts a new 30-day window. Each scan produces a new, independent report so you can see exactly what changed.

A scan uses public certificate discovery data, DNS records, and live connections to public services. You do not provide private keys or server credentials. Reports can reveal infrastructure details, so share full-access links carefully. Read how data is collected, report sharing guidance, and our privacy policy.

Yes. Anyone with the report link sees the summary, with no login or account. Once you buy the full report, the link we email you opens the full version for anyone you forward it to, so share it with care. Links don't expire. The URL isn't indexed or listed anywhere, so it's only accessible to people you send it to.

You can also export the full report in Markdown, CSV, or JSON if you need to drop it into a ticket, a spreadsheet, or your own tooling.

SSLBoard starts with domain-wide hostname discovery and combines evidence from discovered public endpoints in one report. This helps you find inconsistent settings across hosts and addresses, then share affected-host lists with the people responsible for fixes. See what discovery can and cannot cover before treating any external inventory as complete.

SSLBoard reports observed post-quantum key-exchange support and the group where available. This helps identify deployment gaps, but does not establish that every client uses that exchange or that the rest of the application is quantum-safe. Unknown probes are different from confirmed gaps. Read post-quantum readiness results for the classifications and their limits.