SSL/TLS inspector
Inspects certificate, issuer chain, validity, SAN, cipher and HSTS — straight from the XICTRAQ node.
How this tool works
The SSL/TLS inspector opens a real TLS connection to the domain and reads the full certificate: Common Name, Subject Alternative Names (SAN), issuer chain, validity, key type and length, signature algorithm, negotiated TLS version, and cipher suite. It also checks the HSTS header (Strict-Transport-Security) and warns 30 days before certificate expiry. Unlike DNS-only checks, you see the actual TLS reality — not what the DNS says.
Typical use cases
- Before a certificate renewal, verify exact expiry days and SAN list
- After renewal, confirm the new certificate is actually delivered (avoid cache traps)
- Audit TLS versions — TLS 1.0/1.1 are mandatory failures today, TLS 1.2 minimum, TLS 1.3 standard
- For mixed-content warnings, check the SAN list covers subdomains
- Verify a wildcard certificate (*.example.com) actually matches the domain
Frequently asked questions
What does "hostname does not match" mean?
The certificate is valid but does not cover the queried hostname in CN or SAN. Browsers show NET::ERR_CERT_COMMON_NAME_INVALID. Usually a missing SAN.
Why is HSTS so important?
HSTS forces the browser to only use HTTPS for a year — even when the user types http://. Without HSTS the initial HTTP request stays vulnerable to SSL stripping.
Which TLS versions are acceptable today?
TLS 1.2 is the absolute minimum (PCI-DSS, BSI), TLS 1.3 is state-of-the-art and should be enabled. TLS 1.0 and 1.1 must not be used since 2020.
What is OCSP stapling, and does the tool check it?
OCSP stapling lets the server itself include current revocation status, instead of the browser asking the CA. We now check it directly via `openssl s_client -status` and show active/inactive in the result.
Why does the check fail for internal domains?
We only check public, DNS-resolvable hosts. Internal domains (intranet.company.local) are not reachable from our server.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.