TLS Certificate Inspector

Connects to a real server and reads its actual TLS certificate chain — subject, issuer, SAN entries, serial number, validity dates, public key details, signature algorithm, and fingerprints — then flags expired, self-signed, weak-key, weak-signature, or hostname-mismatched certificates. Browsers have no API to expose a cross-origin server's certificate details to a webpage, so this is done server-side by speaking the TLS handshake directly and stopping right after the server sends its certificate (before any encrypted data would ever be exchanged). Requires a live network request. Nothing you inspect is logged or stored.

A note on scope

Only TLS 1.2-style handshakes are attempted (a small, broadly-supported cipher suite list is offered) — servers that require TLS 1.3-only will reject the connection with a protocol_version alert, which is reported as an error rather than silently failing. For safety, connections to localhost and private/loopback/link-local IP ranges are blocked, and the handshake stops the moment the certificate is received — no application data is ever exchanged, and no certificate is trusted or validated against a CA root here (that's what your actual browser already does when it visits the site normally). Sites proxied through Cloudflare itself (including this one) can't be inspected — the platform this tool runs on blocks raw outbound socket connections back into its own edge network, a restriction outside this tool's control; you'll see a connection error for those rather than a certificate. See also the DNS Inspector for CAA records (which restrict which CAs can issue for a domain), and the Hash Generator if you want to compute a fingerprint of your own file to compare.