TLS & Certificate Inspector
Inspect the certificate chain, trust result, protocol support, and HTTPS behavior presented by every resolved endpoint.
Inspect an HTTPS service
This quick inspection sends a bounded set of normal DNS, TLS, and HTTP requests from this scanner. It does not run vulnerability exploits or enroll the hostname in monitoring.
Try , , or .
Internal target controls
Inspection could not complete
Each resolved IP is tested separately. A multi-endpoint service can take several seconds.
- Resolved endpoints
- Critical
- Warnings
- Endpoint consistency
Trust
This scanner’s OpenSSL store
Hostname
Leaf expiry
Negotiated
Findings
Evidence-backed checks for this selected IP, not a blended hostname grade.
No findings were generated
The endpoint did not produce enough evidence to classify.
Connection facts
- Key exchange / group
- ALPN
- OCSP stapling
- HTTP version
- TCP connect
- TLS app-connect
Server-supplied certificate chain
Read from the leaf certificate toward the last certificate the endpoint supplied.
No chain was captured
- Subject
- Issuer
- Valid until
- Public key
- Signature
- SHA-256
- SPKI SHA-256
Names
The final supplied certificate is not necessarily a self-signed trust anchor. Trust validation may complete with a root from the scanner’s local store that the server correctly did not send.
Protocol acceptance
One constrained handshake per protocol version, pinned to this IP and using the requested SNI hostname.
| Version | Result | Cipher negotiated | Key exchange / group | ALPN |
|---|---|---|---|---|
Quick inspection scope: this confirms version acceptance and the cipher selected for this scanner. Full cipher enumeration, client simulation, and crafted vulnerability probes belong to the separate opt-in deep-scan phase and are not implied here.
HTTPS response
- Final status
- Final URL
- Server header
- HTTP version
- Verification behavior
- Certificate verification enabled; no insecure override
Strict Transport Security
- Observed
- Max age
- Include subdomains
- Preload directive
HTTP request path
Redirects are followed manually so every new destination is resolved and safety-checked before a request is made.
No HTTP request evidence
The TLS result may still be available above.
DNS Certification Authority Authorization
The first effective CAA policy observed while walking from the hostname toward its parent domain.
No effective CAA record was returned by this scanner’s DNS query. Absence permits any publicly trusted CA unless another policy mechanism applies.
Raw command evidence
Bounded output retained for troubleshooting parser decisions. Certificate PEM blocks are public certificate material, not private keys.
OpenSSL handshake and chain
HTTP response headers
- Scan mode
- Scanned at
- OpenSSL
- Requested URL
Deep cipher enumeration, vulnerability probes, and SSL Labs comparison remain separate explicit modes for a later phase.