SSL / TLS Checker
Inspect the certificate, trust chain, protocol support, negotiated ciphers, and HTTPS security of a public website or server.
Check an SSL / TLS endpoint
What this SSL / TLS checker tests
The checker resolves the hostname, validates every returned address as a public internet target, and connects directly to the selected IP while retaining the original hostname for Server Name Indication. It reports the leaf certificate, presented chain, operating-system trust result, supported TLS versions, negotiated ciphers, and basic HTTPS security headers.
Understanding the certificate result
A useful certificate must be within its validity dates, match the requested hostname, and build a trusted chain. Each condition is checked separately because an unexpired certificate can still fail hostname or trust validation.
Understanding protocol support
TLS 1.2 and TLS 1.3 are the modern protocol versions expected on public HTTPS services. TLS 1.0 and TLS 1.1 are legacy versions and should normally be disabled unless a documented client compatibility requirement remains.
Why endpoint results can differ
CDNs, load balancers, and multi-region deployments often publish several IP addresses. A certificate or protocol change may reach those endpoints at different times, which is why NetOpsKit lets you inspect each resolved address independently.
Scope of this report
This is a practical endpoint configuration check, not a reproduction of any third-party scoring system. The scan is bounded, does not perform exhaustive cipher enumeration, and does not test application vulnerabilities.
Frequently asked questions
What does this SSL / TLS checker test?
It connects to the selected public endpoint with the submitted hostname as SNI, inspects the certificate and presented chain, tests TLS 1.0 through TLS 1.3 where the scanner supports them, and checks the HTTPS response for HSTS.
Why does the same hostname have several results?
A hostname can resolve to several IPv4 or IPv6 endpoints. Certificate deployment, supported protocols, and server configuration can differ between those endpoints, so each address should be checked separately.
What is a certificate chain?
The leaf certificate identifies the site. Intermediate certificates connect it to a trusted root certificate. A missing or incorrect intermediate can cause trust failures for some clients.
Why can a certificate be valid but not trusted?
The dates and hostname can be correct while the issuing chain is self-signed, incomplete, or unknown to the scanner's operating-system trust store.
Does this report reproduce the SSL Labs grade?
No. NetOpsKit reports directly observed certificate, protocol, cipher, trust, and HTTPS findings. It does not copy or claim Qualys SSL Labs' proprietary grade.