SSL/TLS Deep Inspector
Grade live TLS handshakes with chain trust, protocol, key strength, and expiry checks
Examples
Grade a production site
github.com
443Grade A · TLS 1.3 · chain trusted · 90+ days to expiryWell-configured public sites typically score A when the chain is complete and the certificate is valid.
Catch an expired certificate
expired.badssl.com
443Grade F · certificate expired · critical findingExpiry is a hard fail — renew and redeploy the full chain before retesting.
About this tool
The SSL/TLS Deep Inspector performs a live TLS handshake from the DevTools backend and grades the result A–F. It checks chain trust against system CAs, hostname coverage in SANs, negotiated protocol, key algorithm strength, and days until expiry.
Use this when you need a security grade and remediation-oriented findings — not just certificate field display. For PEM chain parsing from a pasted bundle, use the SSL Chain Analyzer; for a quick certificate field view, the legacy SSL Certificate Checker remains available.
How to use
Enter hostname and port
Type a public hostname (example.com) and port (443 for HTTPS). Private and reserved IPs are blocked.
Run Inspect TLS
The backend completes a handshake and returns a grade, protocol/cipher details, and a findings list.
Fix critical items first
Expired certificates always grade F. Address chain trust and hostname mismatch before tuning cipher preferences.
Use cases
Post-renewal verification
Confirm the new leaf and intermediates are served correctly after certbot or ACME renewal.
Staging vs production comparison
Compare grades between staging and production hostnames before cutover.
Incident triage
Quickly see whether a TLS outage is expiry, chain, or hostname mismatch.
Common mistakes
Mistake:Testing only the leaf in a browser.
Fix:Browsers cache trust and may hide missing intermediates. The inspector evaluates the served chain as clients see it from the server.
Mistake:Using an IP address instead of the certificate's hostname.
Fix:Enter the DNS name on the certificate (SNI hostname). IP-only connections may not match SANs.
Frequently asked questions
Related guides
How to Use the SSL/TLS Deep Inspector (A–F Grading)
Run a live TLS handshake from DevTools backend, interpret the A–F grade, and fix chain, expiry, and protocol findings.
Why Your TLS Certificate Chain Breaks (and How to Fix It)
A field guide to 'unable to get local issuer certificate' and friends. What a certificate chain is, why order and intermediates matter, and how to find the broken link in a PEM bundle.
References & standards
Related tools
SSL Certificate Checker
Analyze SSL/TLS certificates for any domain, check expiration dates, certificate chains, and security details
SSL Chain Analyzer
Paste a PEM certificate bundle and verify the chain order — find missing intermediates, broken links, expired or not-yet-valid certificates, self-signed roots, and duplicates. All in-browser.
Security Headers Checker
Grade CSP, HSTS, and related HTTP security headers from a live response
DNS Propagation Checker
Compare DNS answers from global public resolvers and see propagation consensus instantly