SSL Certificate Check

Opens its own TLS handshakes to one public host with openssl, using the URL's explicit port or 443 by default, and reports what they establish: which of TLS 1.3, TLS 1.2, TLS 1.1, TLS 1.0 and SSLv3 the server accepts, a protocol-support grade, and the certificate the server actually serves (subject, issuer, covered hostnames, hostname match, and validity dates). Reach for it on padlock, HTTPS, 'Not Secure', certificate-expiry and wrong-hostname questions, and to inspect which certificate is served after a renewal on the probed endpoint; this does not verify every load-balanced node. It does not fetch the page or establish whether plain HTTP is actually served or redirected, and it is not a browser trust decision: no chain-of-trust build, no revocation check, no cipher-suite inspection. Measured 0.05-1.5 seconds against real hosts; each probe is cut off at 12 seconds.

{
  "type": "object",
  "properties": {
    "url": {
      "pattern": "^https?://",
      "type": "string",
      "description": "Full public URL of the site to probe. Its hostname and explicit port drive the handshakes; port 443 is used when no port is named. The submitted scheme is reported, but the page is never fetched and plain-HTTP serving or redirects are not tested"
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false
}

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "The URL as requested"
    },
    "host": {
      "type": "string",
      "description": "The hostname the handshakes were opened against"
    },
    "port": {
      "type": "number",
      "description": "The port the handshakes were opened against (443 unless the URL named another)"
    },
    "checkedAt": {
      "type": "string",
      "description": "Probe timestamp"
    },
    "https": {
      "type": "boolean",
      "description": "Whether anything completed a TLS handshake on the port"
    },
    "protocolGrade": {
      "type": "string",
      "description": "A+ (TLS 1.3, no legacy protocols), A, B, or C: read from protocol support ALONE by this app. It ignores the certificate entirely, so an expired or wrong-hostname certificate can still sit behind an A. Not a Qualys SSL Labs grade"
    },
    "servedOverHttp": {
      "type": "boolean",
      "description": "Legacy field name: true when the submitted URL used the http scheme and TLS answered on the probed port. It records the input scheme in this TLS result, not whether HTTP content is served, redirected or enforced"
    },
    "protocols": {
      "type": "object",
      "required": [
        "tls13",
        "tls12",
        "tls11",
        "tls10",
        "ssl3"
      ],
      "properties": {
        "tls13": {
          "type": "boolean",
          "description": "TLS 1.3 accepted"
        },
        "tls12": {
          "type": "boolean",
          "description": "TLS 1.2 accepted"
        },
        "tls11": {
          "type": "boolean",
          "description": "Deprecated TLS 1.1 still accepted"
        },
        "tls10": {
          "type": "boolean",
          "description": "Deprecated TLS 1.0 still accepted"
        },
        "ssl3": {
          "type": "boolean",
          "description": "Obsolete SSLv3 still accepted"
        }
      },
      "description": "Protocol versions the server agreed to speak",
      "additionalProperties": false
    },
    "certificate": {
      "type": "object",
      "required": [
        "names"
      ],
      "properties": {
        "subject": {
          "type": "string",
          "description": "Certificate subject distinguished name"
        },
        "issuer": {
          "type": "string",
          "description": "Issuing CA distinguished name"
        },
        "names": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "DNS names and IP addresses from subjectAltName; the subject common name is display-only"
        },
        "hostnameMatches": {
          "type": "boolean",
          "description": "Whether a DNS subjectAltName matches the probed hostname or an IP subjectAltName matches the probed IP address"
        },
        "issuedAt": {
          "type": "string",
          "description": "Certificate notBefore as an ISO 8601 timestamp (when this certificate became valid, which is what confirms a renewal is the one being served)"
        },
        "expiresAt": {
          "type": "string",
          "description": "Certificate notAfter as an ISO 8601 timestamp"
        },
        "daysUntilExpiry": {
          "type": "number",
          "description": "Rounded days until expiry; use expired for the exact validity state because an expiry within twelve hours can round to zero"
        },
        "expired": {
          "type": "boolean",
          "description": "Whether the certificate is already past its notAfter"
        },
        "expiringSoon": {
          "type": "boolean",
          "description": "Whether the certificate expires within 30 days"
        }
      },
      "description": "The certificate the server served during the handshake",
      "additionalProperties": false
    },
    "issues": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Protocol, certificate, and submitted-scheme observations found by the probe"
    }
  },
  "required": [
    "url",
    "host",
    "port",
    "checkedAt",
    "https",
    "issues"
  ],
  "additionalProperties": false
}