TLS 证书检查
我们会与主机的 443 端口建立 TLS 连接并报告其出示的内容。只连接公网地址。
此内容尚无中文版本。在发布译文之前以英语显示。
When you open an HTTPS site, the server presents a certificate that proves it may use that name, signed by a certificate authority your device trusts. This tool opens a TLS connection to port 443 of the host and reports what it presents: the names the certificate covers, who issued it, when it expires, the chain up to the authority, and the protocol version and cipher that were negotiated.
The handshake is completed even when the certificate doesn’t validate, so you can see why a browser would warn. The host is resolved first and only public addresses are contacted; nothing is sent after the handshake.
常见问题
Why does the certificate not cover my domain?
The certificate's subject alternative names (SAN) must include the exact name, or a wildcard such as *.example.com that matches one label. A certificate for example.com does not cover www.example.com unless both are listed.
How early should I renew?
Automated certificates (for example from Let's Encrypt) renew about 30 days before expiry. If yours has less than two weeks left, check the renewal job.
What does 'not trusted' mean?
The chain doesn't lead to an authority in our trust store: the certificate may be self-signed, expired, or the server may be missing an intermediate certificate.