Mozilla TLS Scanner Getting Started: Quickstart Guide (2026)

Getting started overview

The Mozilla TLS Observatory offers a web-based interface to analyze the TLS configuration of any public-facing server. It evaluates various aspects of the TLS setup, including supported protocols, cipher suites, certificate details, and adherence to security best practices outlined by Mozilla. This guide provides a rapid path to performing your first scan and understanding the initial results.

Unlike API-driven services that require account creation and API keys, the Mozilla TLS Observatory operates as a direct web utility. This simplifies the onboarding process, allowing immediate use for scanning public domains without prior setup or credential management. The tool is designed to provide actionable insights into potential vulnerabilities and areas for improvement in a server's TLS implementation.

The primary output of a scan is a detailed report, which includes a letter grade (A+ through F) summarizing the overall security posture. This grade is based on a comprehensive set of criteria derived from Mozilla's Server-Side TLS guidelines. The report also highlights specific issues, such as weak cipher suites, outdated TLS versions, or certificate problems, offering clear recommendations for remediation.

Quick reference steps

Create an account and get keys

The Mozilla TLS Observatory does not require account creation or API keys. It is a publicly accessible web tool designed for immediate use without authentication. This design choice simplifies the process for developers and system administrators who need to quickly assess the TLS configuration of a server without administrative overhead.

Users can navigate directly to the Mozilla TLS Observatory homepage and begin scanning. There are no registration forms, login prompts, or API key generation steps involved. This aligns with Mozilla's objective of providing accessible security tools to the broader internet community.

For those interested in automating TLS checks or integrating them into CI/CD pipelines, alternative tools or custom scripts that leverage open-source libraries (e.g., OpenSSL) would be necessary, as the Mozilla TLS Observatory does not expose a public API for programmatic access. However, for interactive, on-demand scanning, its web interface is the intended and sole method of interaction.

Your first request

To perform your first scan using the Mozilla TLS Observatory, follow these steps:

1. Navigate to the Tool: Open your web browser and go to the Mozilla TLS Observatory website.
2. Enter Your Domain: Locate the input field, typically labeled "Test your server" or "Enter a domain name." Type the fully qualified domain name (FQDN) of the public server you wish to scan. For example, if you want to scan api.example.com, enter that exact domain. Do not include http:// or https://.
3. Initiate the Scan: Click the button adjacent to the input field, usually labeled "Scan" or "Test."
4. Wait for Results: The tool will then connect to your server, perform a series of tests, and generate a report. This process typically takes a few seconds to a minute, depending on network conditions and server responsiveness.
5. Review the Report: Once the scan is complete, a detailed report will be displayed. This report includes an overall grade (e.g., A+, B, F), a summary of findings, and specific recommendations for improving your server's TLS configuration. Pay close attention to any highlighted warnings or errors.

For instance, if you scan example.com, the report will tell you if it supports modern TLS versions like TLS 1.3, if it uses strong cipher suites, and if its certificate chain is correctly configured. A lower grade might indicate the use of deprecated protocols (e.g., TLS 1.0 or 1.1) or weak cipher suites, which are considered security risks.

The report also details the specific tests performed and the rationale behind the grading. This allows developers and system administrators to understand the exact areas where their server's TLS configuration may deviate from best practices and how to address them.

Common next steps

After successfully performing your first scan with the Mozilla TLS Observatory, several common next steps can help improve your server's security posture:

1. Analyze the Report Details: Do not just look at the overall grade. Dig into the specific findings. The report provides detailed explanations for each issue identified, often with links to relevant documentation or security advisories. Understand why a particular configuration is flagged as problematic.
2. Prioritize Remediation: Focus on critical issues first, such as support for outdated TLS versions (e.g., TLS 1.0/1.1) or the presence of weak cipher suites. These often represent the most significant security vulnerabilities. Refer to Mozilla's Server-Side TLS guidelines for recommended configurations.
3. Implement Recommended Changes: Based on the report's recommendations, make necessary adjustments to your server's TLS configuration. This typically involves modifying server configuration files (e.g., Apache's ssl.conf, Nginx's nginx.conf, or settings in your load balancer/CDN). Ensure you understand the impact of each change before applying it in a production environment.
4. Re-scan Your Domain: After implementing changes, immediately re-scan your domain using the Mozilla TLS Observatory. This step is crucial to verify that your modifications were effective and did not introduce new issues. Continue this cycle of modification and re-scanning until you achieve your desired security grade, ideally an A or A+.
5. Regular Monitoring: TLS configurations can degrade over time due to new vulnerabilities being discovered or changes in best practices. Schedule regular scans (e.g., monthly or quarterly) to ensure your server continuously meets security standards.
6. Explore Advanced TLS Concepts: For deeper understanding, research concepts like HTTP Strict Transport Security (HSTS), certificate pinning, and OCSP stapling, which contribute to a robust TLS implementation.
7. Consult Vendor Documentation: Always refer to the official documentation for your specific web server, load balancer, or CDN for precise instructions on configuring TLS settings. For example, AWS documentation on configuring SSL/TLS on EC2 instances or Cloudflare's guide to TLS 1.3 can provide specific implementation details for their respective platforms.

By following these steps, you can systematically improve and maintain the security of your server's TLS communication, protecting data in transit and enhancing user trust.

Troubleshooting the first call

When performing your first scan with the Mozilla TLS Observatory, you might encounter issues. Here are common problems and their troubleshooting steps:

Domain not found or unreachable

• Problem: The scanner reports that the domain cannot be resolved or is unreachable.
• Solution:
  • Check DNS Resolution: Ensure the domain name you entered is publicly resolvable. You can use tools like nslookup or dig from your command line to verify DNS records.
  • Verify Public Accessibility: Confirm that your server is accessible from the public internet on standard HTTPS port 443. Firewall rules might be blocking incoming connections.
  • Correct Typos: Double-check for any spelling errors in the domain name.

Scan hangs or times out

• Problem: The scan takes an unusually long time and eventually times out without a report.
• Solution:
  • Server Performance: Your server might be under heavy load or experiencing performance issues, preventing it from responding promptly to the scanner's probes.
  • Network Latency: High network latency between the scanner and your server can also cause timeouts.
  • Firewall/IDS/IPS Interference: Aggressive firewall rules, Intrusion Detection Systems (IDS), or Intrusion Prevention Systems (IPS) might be rate-limiting or blocking the scan requests, interpreting them as malicious activity. Temporarily review or adjust these systems if possible.

Incorrect report or unexpected grade

• Problem: The report shows a lower grade than expected, or certain configurations are misidentified.
• Solution:
  • Stale DNS Cache: If you recently updated your server's IP address or TLS configuration, DNS caching might show an old configuration. Wait for DNS propagation and try again.
  • CDN/Load Balancer Configuration: If your domain is behind a CDN or load balancer, the scanner might be testing their TLS configuration, not directly your origin server's. Ensure your CDN/load balancer is configured to pass through or correctly terminate TLS with the desired settings.
  • Multiple TLS Configurations: Some servers might have different TLS configurations for different virtual hosts or IP addresses. Ensure the domain you are testing resolves to the intended server with the correct TLS setup.
  • Review Server Logs: Check your web server's SSL/TLS error logs for any issues during the scan period. This can provide clues about connection failures or protocol negotiation problems.
  • Consult Mozilla Guidelines: Re-read the Mozilla Server-Side TLS guidelines to understand the criteria for grading. What you consider secure might not align with Mozilla's stricter recommendations.

Certificate errors

• Problem: The report indicates issues with your SSL/TLS certificate (e.g., expired, self-signed, chain incomplete).
• Solution:
  • Check Expiration: Ensure your certificate is not expired.
  • Verify Chain: Confirm that your server is sending the full certificate chain, including intermediate certificates, to clients. Tools like openssl s_client -connect yourdomain.com:443 -showcerts can help diagnose this.
  • Trusted CA: Make sure your certificate is issued by a publicly trusted Certificate Authority (CA). Self-signed certificates will always result in warnings.

By systematically addressing these common issues, you can usually resolve problems encountered during your first Mozilla TLS Observatory scan and obtain an accurate assessment of your server's TLS configuration.