TLS / SSL

TLS certificate checker

Inspect the live TLS certificate for any public hostname. We open a real handshake on port 443, read the peer certificate, and report issuer, validity window, hostname coverage, and signature details. Read-only, no cipher scans, no downgrade tests.

discord.com github.com store.steampowered.com mc.hypixel.net

Methodology

Probe
We open a TLS handshake to port 443 with the supplied hostname as the SNI, read the peer certificate via getPeerCertificate(true), and validate the hostname against subjectAlternativeName via tls.checkServerIdentity.
Counts as DOWN
The TLS handshake fails entirely (TCP refused, handshake timeout, or rejected ClientHello), we couldn't read a certificate at all.
Counts as DEGRADED
Reserved for soon-to-expire certificates and warning-only validation issues like a self-signed cert. Browsers may still warn even when our check labels the cert valid.
Detail
All certificate details come from getPeerCertificate(true) on the established socket. We do not enumerate cipher suites, test downgrade attacks, or scan for protocol-level weaknesses; this is read-only certificate inspection.
Cadence
Every 5 minutes, in parallel across 4 independent probe methods (HTTP/1.1 with strict TLS, HTTP/2, a browser User-Agent GET, and a curl-style HEAD) from our edge network. We check probe diversity, not geography — if a site blocks a non-browser User-Agent or only speaks HTTP/1.1, the four cards show it.
Rate-limited targets
If a host returns 429 or consistently drops connections from our IPs, we cap retries at 3 and report the last observed status, we do not flood the target to confirm the outage.
Data source
Our verdict is based on direct multi-method probes, every result above is a live network request, never a Twitter mention or DownDetector aggregate. User reports, when shown, appear separately below as a supplementary signal and are never used to determine the up/down verdict.

Related