TLS Deep Scan — Full Chain, Cipher and Protocol Audit
A deep TLS scan enumerates everything a server will agree to. It walks each protocol version the host still accepts, lists the cipher suites offered under each, validates the certificate chain as a client would build it, and checks whether revocation information is stapled to the handshake. The result is a full picture of your TLS configuration rather than confirmation that one connection succeeded.
Why run it
Because a working connection tells you almost nothing about configuration quality. Your browser negotiated the best option available and told you nothing about the worse options that are still on the table — an obsolete protocol version left enabled for a legacy client that was decommissioned years ago, a weak cipher suite still offered as a fallback. A scan also catches the intermediate certificate problem, where your browser succeeds because it cached an intermediate from another site and a fresh client fails.
Why automate it
TLS configuration drifts from both directions. Your side changes when a load balancer is replaced or a base image is updated, often reverting to a vendor default nobody reviewed. The other side changes too: what counts as acceptable configuration moves as protocol versions are deprecated and browsers begin refusing what they used to tolerate. A configuration that graded well when it was set up quietly becomes a problem without anything on your side changing at all. Scheduled scanning tracks both, and diffing successive results shows exactly what moved and when.
What it gives you
The full inventory of what your server will accept, which is a much larger set than what your browser chose. Run continuously, it catches both configuration drift and the slow tightening of what clients consider acceptable.