--- a/util/prosodyctl/check.lua	Sun Jun 07 20:32:55 2026 +0200
+++ b/util/prosodyctl/check.lua	Fri Jun 12 13:05:10 2026 +0100
@@ -465,6 +465,7 @@
 			"statistics_interval",
 			"tcp_keepalives",
 			"tls_profile",
+			"tls_profile_version",
 			"trusted_proxies",
 			"umask",
 			"use_dane",
@@ -733,6 +734,26 @@
 		end
 
 		do
+			local tlsref = require "prosody.util.tlsref";
+			local tls_profile_name = configmanager.get("*", "tls_profile");
+			local tls_profile_version = configmanager.get("*", "tls_profile_version");
+			local profile, err = tlsref.get_profile(tls_profile_version, tls_profile_name);
+			if not profile then
+				print("");
+				print("    TLS profile selection:");
+				if err == "unknown-version" then
+					print(("        tls_profile_version is set to an unknown value (%q)"):format(tls_profile_version));
+					print(("        Valid values: \"%s\""):format(tlsref.get_valid_versions():concat("\", \"")));
+				elseif err == "unknown-profile" then
+					print(("        tls_profile is set to an unknown value (%q)"):format(tls_profile_name));
+					print(("        Valid values: \"%s\""):format(tlsref.get_valid_profile_names():concat("\", \"")));
+				else
+					print(("        Unknown error loading the configured profile: %s"):format(err));
+				end
+			end
+		end
+
+		do
 			local registration_enabled_hosts = {};
 			for host in enabled_hosts() do
 				local host_modules, component = modulemanager.get_modules_for_host(host);