TLS Checker

Details and how to verify this yourself: Security & privacy.

The tool sits in a window that works like a desktop app: menus on the top row and the full-screen icon at its right (Esc leaves full screen). Help → Keyboard shortcuts… lists the keys.

1. Enter your client ID and secret (get them on the credentials page). Optionally choose to remember them: This tab or This device (until you click Forget).
2. Enter the host (for example example.com) and, if needed, a port. Leave servername empty unless you are connecting to an IP address and need a specific name checked.
3. Press Send request and read the result:
   • trusted: true: the chain leads to a root in the Mozilla trust store, and the certificate covers the host name.
   • verification.errors: why it isn’t trusted, by chain position (depth 0 is the server’s own certificate). Common codes:
     • 10: expired.
     • 18: self-signed.
     • 19: self-signed certificate in the chain, meaning an untrusted root.
     • 20: issuer not found, usually a missing intermediate.
     • 62: host name mismatch.
   • certificates: each certificate decoded, as in the Certificate Decoder. notes points out ordering gaps and expiry.
   • protocol, cipher, key_exchange_group: what the connection negotiated. X25519MLKEM768 means a post-quantum hybrid key exchange.

From code: POST /api/tls/check with {"host": "example.com"}, the MCP tool tls_check, or the A2A skill tls_check. See the reference.

How the check runs.

1. The API passes the host and port to a TLS checker operated by this service. The checker is a container running OpenSSL 3 on the operator’s own server, reached through an authenticated Cloudflare Tunnel.
2. The checker resolves the host once and connects to that exact address, so it cannot be redirected by DNS changes mid-check (DNS rebinding).
3. It runs openssl s_client -showcerts with SNI, the Mozilla CA bundle as the trust store, and -verify_hostname for RFC 6125 host-name verification.
4. The handshake is allowed to complete, so OpenSSL reports its final verdict and every individual verify error.

What is refused.

• Non-public addresses: private, loopback, link-local, CGNAT (100.64/10), documentation, multicast and reserved ranges, for IPv4 and IPv6 (including IPv4-mapped and NAT64 forms). This applies to the address given and to the address the name resolves to.
• Ports other than 443, 8443, 465, 636, 853, 993, 995 and 5061. These speak TLS directly; STARTTLS ports such as 25 and 587 are not supported.
• Malformed host names. The connection target is never passed through a shell.

Limits.

• Timing: 10 seconds per connection, and at most 8 concurrent checks on the checker.
• Rate limits: the normal API limits apply.

Not checked. Revocation (OCSP, CRL), Certificate Transparency compliance, cipher-suite policy, and protocol downgrade behaviour.

What the target sees. A TLS connection from the checker’s network, not from you. The checker sends nothing except a standard TLS ClientHello and closes the connection after the handshake.