Inspect the certificate presented by a real connection
TLS protects the connection between a client and a server. A certificate helps the client authenticate the hostname it intended to reach, while the negotiated protocol and cipher define important properties of the encrypted session. The padlock is therefore about a connection and an identity binding. It does not guarantee that a website’s owner is honest or that the application has no vulnerabilities.
This inspector connects to a public hostname on port 443 and reports the certificate it receives, its dates, subject names, issuer, fingerprint and the negotiated TLS parameters. The trust result uses this server’s Node runtime and its certificate authorities. Your own browser can have a different trust configuration or encounter a different edge server, so treat the report as one clearly described perspective.
Read hostname, validity and trust together
A certificate can be within its validity dates but issued for the wrong hostname. It can also cover the requested hostname while chaining to an authority the client does not trust. Those are separate checks. The inspector retains the hostname and trust error so that a failed result is more informative than a generic “SSL problem” message.
The certificate’s subject alternative names are relevant to hostname coverage. Wildcards have specific matching rules; they do not automatically cover every depth of subdomain. A certificate for one service cannot be assumed to cover another merely because the businesses share a brand. Enter the exact hostname that clients use, including a www prefix when applicable.
The expiry field is shown with the number of complete days remaining at the time of the check. A near-expiry warning is an operational reminder, not evidence that encryption has already stopped working. Automated renewals commonly replace certificates before expiry. Inspect the live endpoint after a renewal rather than assuming a certificate file stored elsewhere is the one clients receive.
The Overview tab explains the findings. Measured data lets you search individual fields and values, while JSON report shows the complete export. Export JSON to retain a baseline, or print the findings for your own records. Review the report before sharing it: browser characteristics, token claims, and file names can reveal information about your setup.
Understand one negotiated handshake
The server and client negotiate a protocol and cipher from what both support. This diagnostic records the outcome of one connection from this service. It does not force a series of protocol versions or enumerate every cipher suite accepted by the destination. Seeing TLS 1.3 here does not prove that the server rejects all older versions.
Server Name Indication sends the requested hostname during the handshake so a shared endpoint can present the appropriate certificate. That matters for content-delivery networks and hosts serving many domains on one address. A raw IP connection without the intended server name can show a default certificate, which is one reason this inspector requests a public hostname rather than an arbitrary IP literal.
The chain shown in the report is the certificate information exposed by the peer and runtime. A client may build trust using additional intermediates or local roots. The inspector does not separately query revocation services, audit Certificate Transparency logs or reproduce every browser’s root-store policy. Those checks require additional evidence.
Use certificate evidence during an incident
When a browser reports a certificate error, record the exact hostname, time and error before changing anything. Compare this inspector’s result with the browser’s own certificate viewer. A difference can reflect a local interception proxy, enterprise root certificates, DNS routing, a misconfigured content-delivery edge or a different network path. It should lead to investigation rather than an immediate assumption about who is responsible.
After deploying a new certificate, verify the endpoint that users actually visit and any relevant redirects. A redirect to another hostname requires a valid connection before the client can safely follow it. This tool inspects the supplied TLS hostname only; use the header tool to inspect redirect behaviour separately.
Do not remove certificate verification from a production client to make an error disappear. Fix the hostname, chain, clock or deployment problem. The inspector deliberately collects metadata even when trust fails so you can see the cause, but that diagnostic behaviour is not a recommendation to accept untrusted connections in ordinary application traffic.
Certificate serial numbers and fingerprints are different identifiers. The fingerprint is computed from the certificate bytes, while the serial is assigned by its issuer. When comparing two observed certificates across networks, compare the complete SHA-256 fingerprint and dates rather than assuming matching subject text means the certificate is identical.
Certificate evidence and its meaning
| Field | What it establishes |
|---|---|
| Trust accepted | This runtime accepted the chain and requested hostname for this connection. |
| Subject alternative names | Names covered by the certificate under hostname-matching rules. |
| SHA-256 fingerprint | A digest identifying the certificate bytes, useful for comparing observations. |
| Protocol and cipher | The parameters negotiated in this one handshake. |
Strengths and limitations
What this is useful for
The report is based on a live connection and includes the certificate, trust outcome and negotiated parameters together. It helps diagnose expiry, hostname and chain problems without requiring browser developer tools. A timestamp and certificate fingerprint make before-and-after deployment comparisons more precise.
What to keep in mind
This is not a full TLS configuration scanner. It does not enumerate accepted cipher suites, independently check revocation or prove all content-delivery edges behave identically. Trust is evaluated from the site server, so enterprise browsers and differently located clients can legitimately receive different results.
Common questions
Does a valid certificate mean the site is safe to buy from?
No. A valid certificate establishes properties of the encrypted connection and hostname authentication. A fraudulent business can operate an HTTPS website with a valid certificate. Evaluate the organisation, payment process and content separately from transport security.
Why does my browser disagree with this tool?
Browsers and this server can use different trust stores, network routes, DNS answers or interception policies. A corporate device may trust an enterprise certificate authority that this server does not. Compare the certificate fingerprint and full error before assuming the two clients observed the same certificate.
Where does the connection originate?
Your hostname is sent to this application’s server, which resolves it to a permitted public IPv4 address and connects on port 443. The destination sees a connection from the site server, not directly from your device. No private keys or account credentials are requested.
Can I inspect a custom port or internal server?
This implementation restricts checks to public hostnames and the default HTTPS port. Private destinations, raw IP targets and custom ports are excluded. For an internal service, use an authorised diagnostic tool on the relevant network with the correct server name and trust configuration.