---
title: "TLS version & cipher check — Lemwatch Help"
description: "Confirms your server supports TLS 1.2/1.3, rejects TLS 1.0/1.1, and uses forward-secret cipher suites."
canonical: "https://lemwatch.com/help/tls-version-check"
source: "https://lemwatch.com"
---

# TLS version & cipher check

> Confirms your server supports TLS 1.2/1.3, rejects TLS 1.0/1.1, and uses forward-secret cipher suites.

## Quick answer

 We negotiate handshakes across TLS 1.0-1.3 and record which versions and ciphers your server accepts.

## What it checks

- TLS 1.3 supported (+bonus)

- TLS 1.2 supported (required)

- TLS 1.0/1.1 rejected (required for A grade)

- Forward-secret ciphers only (ECDHE-based)

- No RC4, 3DES, or export ciphers

## Where to find it in Lemwatch

 **Site details → Security → SSL.**

## How to fix

- In nginx/Apache, set ssl_protocols TLSv1.2 TLSv1.3; .

- Use Mozilla SSL Config Generator's "intermediate" profile.

- Reload the server.

- Re-run the check.

## FAQ

### Will disabling TLS 1.0 break old clients?

 Maybe IE10 on Windows 7. All modern browsers/apps support 1.2+.

### Should I enable TLS 1.3 only?

 Too aggressive — some corporate proxies stall on 1.3.

## Related

- SSL monitoring

- Why did my SSL grade drop

- Certificate chain check


## Related

- [Help centre](https://lemwatch.com/help)
- [SSL Certificate Monitoring](https://lemwatch.com/help/ssl-monitoring)
- [Why did my SSL grade drop?](https://lemwatch.com/help/why-ssl-grade-dropped)
- [Certificate chain check](https://lemwatch.com/help/certificate-chain-check)
- [HTTP/2 & HTTP/3 support check](https://lemwatch.com/help/http2-http3-support-check)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [Traffic Analytics](https://lemwatch.com/help/traffic-analytics)
- [How do I change my timezone and date format?](https://lemwatch.com/help/timezone-locale-settings)