MCP Maigret vs SSL Certificate Check

Opens its own TLS handshakes to one public host with openssl, using the URL's explicit port or 443 by default, and reports what they establish: which of TLS 1.3, TLS 1.2, TLS 1.1, TLS 1.0 and SSLv3 the server accepts, a protocol-support grade, and the certificate the server actually serves (subject, issuer, covered hostnames, hostname match, and validity dates). Reach for it on padlock, HTTPS, 'Not Secure', certificate-expiry and wrong-hostname questions, and to inspect which certificate is served after a renewal on the probed endpoint; this does not verify every load-balanced node. It does not fetch the page or establish whether plain HTTP is actually served or redirected, and it is not a browser trust decision: no chain-of-trust build, no revocation check, no cipher-suite inspection. Measured 0.05-1.5 seconds against real hosts; each probe is cut off at 12 seconds.