# SSL Certificate Check [Verified owner] [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://powmcp.com/apps/ssl-certificate-check/  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/ssl-certificate-check

## Description
Inspect the certificate and negotiated TLS version served by a public HTTPS endpoint. Reports certificate details, hostname coverage and expiry for a bounded, read-only check. It does not perform full-chain validation, revocation or cipher-suite auditing. Connect through the hosted PowMCP MCP endpoint; guest access is available, with optional account linking and paid usage plans.

## Tools
Capabilities this server exposes over MCP:

- **ssl_check** — Opens its own TLS handshakes to one public host with openssl, using the URL's explicit port or 443 by default, and reports what they establish: which of TLS 1.3, TLS 1.2, TLS 1.1, TLS 1.0 and SSLv3 the server accepts, a protocol-support grade, and the certificate the server actually serves (subject, issuer, covered hostnames, hostname match, and validity dates). Reach for it on padlock, HTTPS, 'Not Secure', certificate-expiry and wrong-hostname questions, and to inspect which certificate is served after a renewal on the probed endpoint; this does not verify every load-balanced node. It does not fetch the page or establish whether plain HTTP is actually served or redirected, and it is not a browser trust decision: no chain-of-trust build, no revocation check, no cipher-suite inspection. Measured 0.05-1.5 seconds against real hosts; each probe is cut off at 12 seconds.

## Claude Desktop Quick Installation
No confirmed install details yet, so no config is published. Follow the setup steps in the repository above.

## Documentation

## What SSL Certificate Check does

The SSL Certificate Check MCP server examines one public HTTPS host at a time. It reports which certificate the endpoint serves during the probe, including the certificate subject, issuer, covered hostnames, hostname-match result, and validity dates. It also checks support for TLS 1.3, TLS 1.2, TLS 1.1, TLS 1.0, and SSLv3, then provides a protocol-support grade.

The check is useful when investigating browser padlock or “Not Secure” questions, an unexpected hostname, an approaching certificate expiry, or the certificate returned after a renewal. It is read-only and does not retrieve the target web page.

## How it works

The hosted MCP endpoint runs the check against a public host. The `ssl_check` tool opens its own TLS handshakes with `openssl`. A URL may specify a port; when it does not, the check uses port 443. Results describe what the probed endpoint establishes rather than making a general browser trust decision.

Individual measurements against real hosts typically take between 0.05 and 1.5 seconds. Each probe is stopped after 12 seconds. Because the check targets the endpoint reached for that probe, it does not establish that every node behind a load balancer serves the same certificate.

## Setup and configuration

Guest access is available. Account linking is optional, and paid usage plans are available for users who need them.

## Tools and capabilities

The server exposes one MCP tool:

- `ssl_check`: Probes a public HTTPS host, using its explicit URL port or 443 by default. It reports accepted TLS versions, a protocol-support grade, and details of the certificate served by that endpoint.

The SSL Certificate Check MCP server can help confirm whether a certificate covers the requested hostname, identify its issuer and validity period, and inspect the result of a certificate renewal on the endpoint being tested.

## Limitations and notes

This is a bounded endpoint check, not a complete TLS assessment. It does not build or validate the full certificate chain, check revocation status, inspect cipher suites, or determine whether plain HTTP is available or redirects to HTTPS. Its certificate result is not equivalent to a browser’s trust decision.

The check also does not fetch page content. Results apply to the host and endpoint reached during the probe, so they may not represent all load-balanced nodes. SSLv3 and older TLS versions are reported as part of the protocol check when the endpoint accepts them; the tool does not provide broader configuration auditing beyond the listed protocol support and certificate fields.

_Full upstream README: https://allmcps.com/mcp/ssl-certificate-check/readme_