SSL Certificate Check

What SSL Certificate Check does

The SSL Certificate Check MCP server examines one public HTTPS host at a time. It reports which certificate the endpoint serves during the probe, including the certificate subject, issuer, covered hostnames, hostname-match result, and validity dates. It also checks support for TLS 1.3, TLS 1.2, TLS 1.1, TLS 1.0, and SSLv3, then provides a protocol-support grade.

The check is useful when investigating browser padlock or “Not Secure” questions, an unexpected hostname, an approaching certificate expiry, or the certificate returned after a renewal. It is read-only and does not retrieve the target web page.

How it works

The hosted MCP endpoint runs the check against a public host. The ssl_check tool opens its own TLS handshakes with openssl. A URL may specify a port; when it does not, the check uses port 443. Results describe what the probed endpoint establishes rather than making a general browser trust decision.

Individual measurements against real hosts typically take between 0.05 and 1.5 seconds. Each probe is stopped after 12 seconds. Because the check targets the endpoint reached for that probe, it does not establish that every node behind a load balancer serves the same certificate.

Setup and configuration

Guest access is available. Account linking is optional, and paid usage plans are available for users who need them.

Tools and capabilities

The server exposes one MCP tool:

• ssl_check: Probes a public HTTPS host, using its explicit URL port or 443 by default. It reports accepted TLS versions, a protocol-support grade, and details of the certificate served by that endpoint.

The SSL Certificate Check MCP server can help confirm whether a certificate covers the requested hostname, identify its issuer and validity period, and inspect the result of a certificate renewal on the endpoint being tested.

Limitations and notes

This is a bounded endpoint check, not a complete TLS assessment. It does not build or validate the full certificate chain, check revocation status, inspect cipher suites, or determine whether plain HTTP is available or redirects to HTTPS. Its certificate result is not equivalent to a browser’s trust decision.

The check also does not fetch page content. Results apply to the host and endpoint reached during the probe, so they may not represent all load-balanced nodes. SSLv3 and older TLS versions are reported as part of the protocol check when the endpoint accepts them; the tool does not provide broader configuration auditing beyond the listed protocol support and certificate fields.