SSL Certificate Check

Opens its own TLS handshakes to one public host with openssl, using the URL's explicit port or 443 by default, and reports what they establish: which of TLS 1.3, TLS 1.2, TLS 1.1, TLS 1.0 and SSLv3 the server accepts, a protocol-support grade, and the certificate the server actually serves (subject, issuer, covered hostnames, hostname match, and validity dates). Reach for it on padlock, HTTPS, 'Not Secure', certificate-expiry and wrong-hostname questions, and to inspect which certificate is served after a renewal on the probed endpoint; this does not verify every load-balanced node. It does not fetch the page or establish whether plain HTTP is actually served or redirected, and it is not a browser trust decision: no chain-of-trust build, no revocation check, no cipher-suite inspection. Measured 0.05-1.5 seconds against real hosts; each probe is cut off at 12 seconds.