TLS Certificate Inspector

This tool performs a point-in-time TLS handshake to the requested public hostname on TCP/443.

The runner resolves the hostname using the OSINT.dev network-safety layer, rejects non-public destinations, pins the connection to the validated public IP and keeps TLS SNI and hostname checking tied to the original hostname.

Returned evidence

The tool can expose:

negotiated TLS protocol and cipher;
ALPN selection;
leaf certificate subject and issuer;
Subject Alternative Names (SANs);
certificate validity window;
SHA-256 fingerprint and serial number;
summarized certificate chain;
runtime trust-chain status;
hostname-match status.

Interpretation

Certificate data is point-in-time network evidence. CDN, anycast and edge routing can cause different locations to present different certificates. A valid certificate is not evidence that the site content itself is trustworthy.

Custom ports are intentionally not supported in this version so the feature remains a certificate inspector rather than a generic service scanner.

References

Node.js TLS API: https://nodejs.org/api/tls.html
RFC 8446 — TLS 1.3: https://www.rfc-editor.org/info/rfc8446