TLS Endpoint Inspector

It connects to one public host and port and reports which TLS versions the server accepts (TLS 1.0, 1.1, 1.2 and 1.3, each tested with a separate handshake), the protocol, cipher suite and ALPN negotiated by a default connection, and the served certificate: subject, issuer, validity dates, subject alternative names, key type and size, serial number, SHA-256 fingerprint, chain, trust and hostname validation.

Supported means the handshake completed with exactly that version. Not offered means the server answered with an alert, another version or a closed connection. Not testable here means the checker’s own TLS library refused to offer the version, so support is unknown rather than disabled. Timed out and Network error mean no TLS answer arrived. TLS 1.0 and TLS 1.1 are labelled Deprecated because RFC 8996 deprecates them.

The tool shows the most useful certificate fields and lets you copy or download the leaf certificate as PEM. For extensions, policies and a full decode, select Inspect in X.509 Certificate Inspector: the PEM moves to that tool in memory only, without being stored or placed in the URL.

Checks run on CodingTool servers because browsers cannot perform raw TLS handshakes. The hostname is resolved once; if any DNS answer is private, local or reserved, nothing is contacted. Every connection goes to that single checked public address, with the hostname used only for SNI and certificate validation. Each check opens at most five connections, stops after 10 seconds, is rate limited, and nothing about the target or certificate is stored or logged.

Only one address is tested, so hosts behind several addresses or load balancers may answer differently elsewhere. Results depend on the checker’s TLS library, which may not offer every legacy cipher. The tool does not enumerate all cipher suites, test client certificates or check revocation, and it checks one host per request.