> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iotools.cloud/llms.txt
> Use this file to discover all available pages before exploring further.
# TLS/SSL Config Snippet Grader
> Paste an Apache or Nginx TLS/SSL config block and get an A-to-F security grade, a finding-by-finding breakdown (deprecated protocols, weak ciphers, missing HSTS/OCSP stapling), and a Mozilla best-practice replacement snippet. Analyzed entirely in your browser — nothing is sent to a server.
[Try TLS/SSL Config Snippet Grader in your browser →](https://iotools.cloud/tool/tls-ssl-config-snippet-grader/)
## OpenAPI
````yaml https://api.iotools.cloud/v1/openapi post /v1/tool/tls-ssl-config-snippet-grader
openapi: 3.1.0
info:
title: iotools.cloud API
version: 1.0.0
description: >-
Run any iotools.cloud tool over HTTP.
Authenticate with `Authorization: Bearer iot_live_…`.
**Only `POST /v1/tool/{slug}` costs credits.** Every GET here — the catalog,
a tool's schema, your balance — is free. A tool call is charged its own
weight or your plan's per-call minimum, whichever is larger;
`x-iotools-credit-cost` on each operation is quoted at the free-tier
minimum, and `GET /v1/tools/list` returns the exact figure for your key.
`GET /v1/me/credits` reports what you have left, and `GET /v1/me/usage`
reports what it went on.
Failures are RFC 9457 problem documents — branch on `code`.
servers:
- url: https://api.iotools.cloud
description: Production
security:
- bearerAuth: []
tags:
- name: Catalog
description: Find a tool and read its contract. Free.
- name: Converters
description: >-
Convert between formats, encodings, and units — Base64, CSV and JSON,
timestamps, and more. Fast, free, and processed right in your browser.
- name: Formatters
description: >-
Format, beautify, minify, and validate code and data — JSON, HTML, CSS,
SQL, and regex. Clean up messy input in one click, with nothing to upload.
- name: Generators
description: >-
Generate exactly what you need and on demand — passwords, UUIDs, QR codes,
hashes, random numbers, and more. Secure, instant, and free.
- name: Calculators
description: >-
Crunch the numbers fast — from everyday math to specialized conversions
and unit work. Free online calculators that run entirely in your browser.
- name: Editors
description: >-
Edit and transform text, code, and images with quick, focused editors that
run entirely in your browser — nothing to install, and no sign-up needed.
- name: Utilities
description: >-
Everyday developer and web utilities — DNS and IP lookups, redirect and
certificate checkers, and other quick diagnostics. Free and
privacy-friendly.
- name: Account
description: Your key's allowance, limits and usage history.
paths:
/v1/tool/tls-ssl-config-snippet-grader:
post:
tags:
- Utilities
summary: TLS/SSL Config Snippet Grader
description: >-
Paste an Apache or Nginx TLS/SSL config block and get an A-to-F security
grade, a finding-by-finding breakdown (deprecated protocols, weak
ciphers, missing HSTS/OCSP stapling), and a Mozilla best-practice
replacement snippet. Analyzed entirely in your browser — nothing is sent
to a server.
[Try TLS/SSL Config Snippet Grader in your browser
→](https://iotools.cloud/tool/tls-ssl-config-snippet-grader/)
operationId: run_tls_ssl_config_snippet_grader
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
configInput:
type: string
description: TLS/SSL Config Snippet
serverType:
enum:
- auto
- apache
- nginx
description: Server Type
targetProfile:
enum:
- modern
- intermediate
- old
description: Mozilla Profile
required: []
examples:
good_nginx_config_intermediate:
summary: Good Nginx config (intermediate)
value:
configInput: |-
server {
listen 443 ssl http2;
server_name example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers on;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
root /var/www/example.com/public;
}
serverType: auto
targetProfile: intermediate
weak_apache_config_intermediate:
summary: Weak Apache config (intermediate)
value:
configInput: |-
ServerName example.com
DocumentRoot /var/www/example.com/public
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
SSLProtocol all -SSLv3
SSLCipherSuite HIGH:!aNULL:!MD5:RC4
SSLHonorCipherOrder on
serverType: auto
targetProfile: intermediate
responses:
'200':
description: Tool output
content:
application/json:
examples:
good_nginx_config_intermediate:
summary: Good Nginx config (intermediate)
value:
tool: tls-ssl-config-snippet-grader
tool_version: 1.0.1
outputs:
gradeSummary:
- metric: Grade
value: >-
A — Excellent — config follows current best
practices.
- metric: Score
value: 100 / 100
- metric: Server
value: Nginx
- metric: Profile
value: Intermediate
findings:
- severity: OK
issue: No deprecated protocols enabled
detail: TLS 1.0/1.1/SSLv2/SSLv3 are correctly disabled.
impact: ''
- severity: OK
issue: Forward-secret (ECDHE) ciphers present
detail: Server supports perfect forward secrecy.
impact: ''
- severity: OK
issue: HSTS configured with strong max-age
detail: max-age=63072000; includeSubDomains
impact: ''
- severity: OK
issue: OCSP stapling enabled
detail: Faster, more private handshakes.
impact: ''
suggestion: >-
# Mozilla Intermediate configuration (Nginx)
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_conf_command Ciphersuites
TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
ssl_prefer_server_ciphers on;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security "max-age=63072000;
includeSubDomains" always;
credits_used: 3
credits_remaining: null
weak_apache_config_intermediate:
summary: Weak Apache config (intermediate)
value:
tool: tls-ssl-config-snippet-grader
tool_version: 1.0.1
outputs:
gradeSummary:
- metric: Grade
value: F — Failing — critical vulnerabilities present.
- metric: Score
value: 15 / 100
- metric: Server
value: Apache
- metric: Profile
value: Intermediate
findings:
- severity: CRITICAL
issue: TLS 1.0 enabled
detail: >-
TLS 1.0 is deprecated (RFC 8996) and disallowed by
PCI DSS / browser vendors.
impact: '-20 pts'
- severity: CRITICAL
issue: TLS 1.1 enabled
detail: TLS 1.1 is deprecated (RFC 8996). Disable it.
impact: '-20 pts'
- severity: CRITICAL
issue: 'Weak cipher token: RC4'
detail: RC4 is broken and prohibited by RFC 7465.
impact: '-15 pts'
- severity: CRITICAL
issue: No forward-secret (ECDHE/DHE) ciphers
detail: >-
Without forward secrecy, a compromised server key
decrypts all past traffic.
impact: '-15 pts'
- severity: WARNING
issue: Cipher list relies on OpenSSL aliases (HIGH/MEDIUM)
detail: >-
Aliases like HIGH change across OpenSSL versions.
Prefer an explicit list of ECDHE/forward-secret
suites.
impact: '-5 pts'
- severity: WARNING
issue: No HSTS header
detail: >-
Without Strict-Transport-Security, downgrade attacks
(SSL stripping) remain possible.
impact: '-8 pts'
- severity: INFO
issue: OCSP stapling not configured
detail: >-
Enable SSLUseStapling on (Apache) or ssl_stapling on
(Nginx).
impact: '-2 pts'
suggestion: >-
# Mozilla Intermediate configuration (Apache)
SSLProtocol all -SSLv2 -SSLv3 -TLSv1
-TLSv1.0 -TLSv1.1
SSLCipherSuite
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLOpenSSLConfCmd Ciphersuites
TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
SSLHonorCipherOrder on
SSLSessionTickets off
SSLUseStapling on
SSLStaplingCache
"shmcb:logs/stapling-cache(150000)"
Header always set Strict-Transport-Security
"max-age=63072000; includeSubDomains"
credits_used: 3
credits_remaining: null
schema:
type: object
required:
- tool
- tool_version
- outputs
- credits_used
- credits_remaining
properties:
outputs:
type: object
properties:
gradeSummary:
type: array
items:
type: object
properties:
metric:
type: string
description: Metric
value:
type: string
description: Value
x-iotools-columns:
- metric
- value
findings:
type: array
items:
type: object
properties:
severity:
type: string
description: Severity
issue:
type: string
description: Issue
detail:
type: string
description: Detail
impact:
type: string
description: Impact
x-iotools-columns:
- severity
- issue
- detail
- impact
suggestion:
type: string
tool:
type: string
description: The tool's slug, echoing the {slug} in the request path.
tool_version:
type: string
description: Output-contract version for this tool.
credits_used:
type: integer
description: >-
Credits this call consumed, after any settlement refund. 0
when metering is disabled.
credits_remaining:
type:
- integer
- 'null'
description: >-
Credits left in the current monthly allowance, or null
when metering is disabled.
request_id:
type: string
description: Correlation id, also sent as x-request-id.
'400':
$ref: '#/components/responses/ValidationError'
'401':
$ref: '#/components/responses/Unauthorized'
'402':
$ref: '#/components/responses/InsufficientCredits'
'403':
$ref: '#/components/responses/ToolNotAllowed'
'404':
$ref: '#/components/responses/ToolNotFound'
'413':
$ref: '#/components/responses/PayloadTooLarge'
'429':
$ref: '#/components/responses/RateLimited'
'500':
$ref: '#/components/responses/ToolFailed'
'503':
$ref: '#/components/responses/ToolDisabled'
security:
- bearerAuth: []
components:
responses:
ValidationError:
description: Invalid request.
content:
application/problem+json:
schema:
type: object
description: >-
RFC 9457 problem document, served as application/problem+json.
Branch on `code`; `title` is human prose and may be reworded
without notice. Some failures add extension members — `fields` on
validation errors, `retry_after` on 429s,
`credits_used`/`credits_remaining` on billing-adjacent failures —
documented on the responses that carry them.
required:
- type
- title
- status
- code
properties:
type:
type: string
format: uri
description: Stable documentation URI for this failure.
examples:
- https://iotools.cloud/docs/errors/validation_error
title:
type: string
description: Short human-readable summary of the failure.
examples:
- Invalid request
status:
type: integer
description: HTTP status code, matching the response's own status.
code:
type: string
description: >-
Stable machine-readable error code — branch on this, not
`title`.
enum:
- validation_error
detail:
type: string
description: Human explanation of this occurrence.
request_id:
type: string
description: Correlation id, also sent as x-request-id.
fields:
type:
- object
- string
additionalProperties:
type: string
description: >-
What failed: a map of field name → message. Absent when the
body itself is malformed; a single string when the failure
isn't tied to one field.
example:
type: https://iotools.cloud/docs/errors/validation_error
title: Invalid request
status: 400
code: validation_error
detail: One or more inputs are invalid — see `fields`.
request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11
fields:
inputString: Required
Unauthorized:
description: Missing or invalid API key.
content:
application/problem+json:
schema:
type: object
description: >-
RFC 9457 problem document, served as application/problem+json.
Branch on `code`; `title` is human prose and may be reworded
without notice. Some failures add extension members — `fields` on
validation errors, `retry_after` on 429s,
`credits_used`/`credits_remaining` on billing-adjacent failures —
documented on the responses that carry them.
required:
- type
- title
- status
- code
properties:
type:
type: string
format: uri
description: Stable documentation URI for this failure.
examples:
- https://iotools.cloud/docs/errors/invalid_api_key
title:
type: string
description: Short human-readable summary of the failure.
examples:
- Invalid API key
status:
type: integer
description: HTTP status code, matching the response's own status.
code:
type: string
description: >-
Stable machine-readable error code — branch on this, not
`title`.
enum:
- invalid_api_key
detail:
type: string
description: Human explanation of this occurrence.
request_id:
type: string
description: Correlation id, also sent as x-request-id.
example:
type: https://iotools.cloud/docs/errors/invalid_api_key
title: Invalid API key
status: 401
code: invalid_api_key
detail: 'Provide ''Authorization: Bearer ''.'
request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11
InsufficientCredits:
description: Monthly credit allowance exhausted.
content:
application/problem+json:
schema:
type: object
description: >-
RFC 9457 problem document, served as application/problem+json.
Branch on `code`; `title` is human prose and may be reworded
without notice. Some failures add extension members — `fields` on
validation errors, `retry_after` on 429s,
`credits_used`/`credits_remaining` on billing-adjacent failures —
documented on the responses that carry them.
required:
- type
- title
- status
- code
properties:
type:
type: string
format: uri
description: Stable documentation URI for this failure.
examples:
- https://iotools.cloud/docs/errors/insufficient_credits
title:
type: string
description: Short human-readable summary of the failure.
examples:
- Insufficient credits
status:
type: integer
description: HTTP status code, matching the response's own status.
code:
type: string
description: >-
Stable machine-readable error code — branch on this, not
`title`.
enum:
- insufficient_credits
detail:
type: string
description: Human explanation of this occurrence.
request_id:
type: string
description: Correlation id, also sent as x-request-id.
credits_used:
type: integer
description: Always 0 — a refused call charges nothing.
credits_remaining:
type: integer
description: Credits left in the allowance — fewer than this call costs.
example:
type: https://iotools.cloud/docs/errors/insufficient_credits
title: Insufficient credits
status: 402
code: insufficient_credits
detail: This call costs 1 credit and 0 remain in this month's allowance.
request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11
credits_used: 0
credits_remaining: 0
ToolNotAllowed:
description: Tool exists but has no API surface.
content:
application/problem+json:
schema:
type: object
description: >-
RFC 9457 problem document, served as application/problem+json.
Branch on `code`; `title` is human prose and may be reworded
without notice. Some failures add extension members — `fields` on
validation errors, `retry_after` on 429s,
`credits_used`/`credits_remaining` on billing-adjacent failures —
documented on the responses that carry them.
required:
- type
- title
- status
- code
properties:
type:
type: string
format: uri
description: Stable documentation URI for this failure.
examples:
- https://iotools.cloud/docs/errors/tool_not_allowed
title:
type: string
description: Short human-readable summary of the failure.
examples:
- Tool not available over the API
status:
type: integer
description: HTTP status code, matching the response's own status.
code:
type: string
description: >-
Stable machine-readable error code — branch on this, not
`title`.
enum:
- tool_not_allowed
detail:
type: string
description: Human explanation of this occurrence.
request_id:
type: string
description: Correlation id, also sent as x-request-id.
example:
type: https://iotools.cloud/docs/errors/tool_not_allowed
title: Tool not available over the API
status: 403
code: tool_not_allowed
detail: >-
"Background Remover" is available on iotools.cloud but has no API
endpoint.
request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11
ToolNotFound:
description: No such tool.
content:
application/problem+json:
schema:
type: object
description: >-
RFC 9457 problem document, served as application/problem+json.
Branch on `code`; `title` is human prose and may be reworded
without notice. Some failures add extension members — `fields` on
validation errors, `retry_after` on 429s,
`credits_used`/`credits_remaining` on billing-adjacent failures —
documented on the responses that carry them.
required:
- type
- title
- status
- code
properties:
type:
type: string
format: uri
description: Stable documentation URI for this failure.
examples:
- https://iotools.cloud/docs/errors/tool_not_found
title:
type: string
description: Short human-readable summary of the failure.
examples:
- Tool not found
status:
type: integer
description: HTTP status code, matching the response's own status.
code:
type: string
description: >-
Stable machine-readable error code — branch on this, not
`title`.
enum:
- tool_not_found
detail:
type: string
description: Human explanation of this occurrence.
request_id:
type: string
description: Correlation id, also sent as x-request-id.
example:
type: https://iotools.cloud/docs/errors/tool_not_found
title: Tool not found
status: 404
code: tool_not_found
detail: No tool with that slug. See GET /v1/tools/list.
request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11
PayloadTooLarge:
description: Body too large.
content:
application/problem+json:
schema:
type: object
description: >-
RFC 9457 problem document, served as application/problem+json.
Branch on `code`; `title` is human prose and may be reworded
without notice. Some failures add extension members — `fields` on
validation errors, `retry_after` on 429s,
`credits_used`/`credits_remaining` on billing-adjacent failures —
documented on the responses that carry them.
required:
- type
- title
- status
- code
properties:
type:
type: string
format: uri
description: Stable documentation URI for this failure.
examples:
- https://iotools.cloud/docs/errors/payload_too_large
title:
type: string
description: Short human-readable summary of the failure.
examples:
- Payload too large
status:
type: integer
description: HTTP status code, matching the response's own status.
code:
type: string
description: >-
Stable machine-readable error code — branch on this, not
`title`.
enum:
- payload_too_large
detail:
type: string
description: Human explanation of this occurrence.
request_id:
type: string
description: Correlation id, also sent as x-request-id.
example:
type: https://iotools.cloud/docs/errors/payload_too_large
title: Payload too large
status: 413
code: payload_too_large
detail: Request body exceeds this tool's size limit.
request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11
RateLimited:
description: Per-minute rate limit exceeded.
headers:
Retry-After:
description: Seconds to wait before retrying (RFC 9110 delta-seconds).
schema:
type: integer
content:
application/problem+json:
schema:
type: object
description: >-
RFC 9457 problem document, served as application/problem+json.
Branch on `code`; `title` is human prose and may be reworded
without notice. Some failures add extension members — `fields` on
validation errors, `retry_after` on 429s,
`credits_used`/`credits_remaining` on billing-adjacent failures —
documented on the responses that carry them.
required:
- type
- title
- status
- code
properties:
type:
type: string
format: uri
description: Stable documentation URI for this failure.
examples:
- https://iotools.cloud/docs/errors/rate_limited
title:
type: string
description: Short human-readable summary of the failure.
examples:
- Rate limit exceeded
status:
type: integer
description: HTTP status code, matching the response's own status.
code:
type: string
description: >-
Stable machine-readable error code — branch on this, not
`title`.
enum:
- rate_limited
detail:
type: string
description: Human explanation of this occurrence.
request_id:
type: string
description: Correlation id, also sent as x-request-id.
retry_after:
type: integer
description: >-
Seconds until the window resets — the same value as the
`Retry-After` header.
example:
type: https://iotools.cloud/docs/errors/rate_limited
title: Rate limit exceeded
status: 429
code: rate_limited
detail: Too many requests. Retry in 30s.
request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11
retry_after: 30
ToolFailed:
description: Tool failed to run.
content:
application/problem+json:
schema:
type: object
description: >-
RFC 9457 problem document, served as application/problem+json.
Branch on `code`; `title` is human prose and may be reworded
without notice. Some failures add extension members — `fields` on
validation errors, `retry_after` on 429s,
`credits_used`/`credits_remaining` on billing-adjacent failures —
documented on the responses that carry them.
required:
- type
- title
- status
- code
properties:
type:
type: string
format: uri
description: Stable documentation URI for this failure.
examples:
- https://iotools.cloud/docs/errors/processing_error
- https://iotools.cloud/docs/errors/internal_error
title:
type: string
description: Short human-readable summary of the failure.
examples:
- Tool failed to run
- Internal error
status:
type: integer
description: HTTP status code, matching the response's own status.
code:
type: string
description: >-
Stable machine-readable error code — branch on this, not
`title`.
enum:
- processing_error
- internal_error
detail:
type: string
description: Human explanation of this occurrence.
request_id:
type: string
description: Correlation id, also sent as x-request-id.
credits_used:
type: integer
description: >-
Always 0 on `processing_error` — a failed run is refunded,
floor included.
credits_remaining:
type: integer
description: >-
Credits left after the refund. Absent when metering is
disabled.
example:
type: https://iotools.cloud/docs/errors/processing_error
title: Tool failed to run
status: 500
code: processing_error
detail: The tool failed to run. Please try again.
request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11
credits_used: 0
ToolDisabled:
description: Tool temporarily disabled.
content:
application/problem+json:
schema:
type: object
description: >-
RFC 9457 problem document, served as application/problem+json.
Branch on `code`; `title` is human prose and may be reworded
without notice. Some failures add extension members — `fields` on
validation errors, `retry_after` on 429s,
`credits_used`/`credits_remaining` on billing-adjacent failures —
documented on the responses that carry them.
required:
- type
- title
- status
- code
properties:
type:
type: string
format: uri
description: Stable documentation URI for this failure.
examples:
- https://iotools.cloud/docs/errors/tool_disabled
- https://iotools.cloud/docs/errors/api_unconfigured
title:
type: string
description: Short human-readable summary of the failure.
examples:
- Tool temporarily disabled
- API not configured
status:
type: integer
description: HTTP status code, matching the response's own status.
code:
type: string
description: >-
Stable machine-readable error code — branch on this, not
`title`.
enum:
- tool_disabled
- api_unconfigured
detail:
type: string
description: Human explanation of this occurrence.
request_id:
type: string
description: Correlation id, also sent as x-request-id.
example:
type: https://iotools.cloud/docs/errors/tool_disabled
title: Tool temporarily disabled
status: 503
code: tool_disabled
detail: This tool is temporarily unavailable. Try again shortly.
request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: iot_live_…
````