TLS Certificate
Open one TLS handshake to a host and port you choose, and see the protocol, the cipher, the expiry and the chain.
The check runs on your computer through the local agent. The host, the port and the chain stay on this page.
Local agent
Paste the current code from the agent window. The field is cleared after each attempt.
Agent disconnected
Set up the agent
Download and start the local agent, then come back to this page.
About the agent and download- Start MyDevTools Agent. A private or loopback address needs the agent started with --allow-private.
- Copy the pairing code from the agent window.
- Paste the code below. If the browser asks for local-network access, allow it for this connection.
The browser sends the host, the port and the timeout only to the agent on 127.0.0.1. The agent opens one TLS handshake and closes it without application data. It does not fetch extra certificates. It does not parse a pasted PEM; that stays in the certificate tool. The check does not go to a MyDevTools server. This browser remembers the timeout. It does not store the host, the port or the chain.
Check
One host name or IP address. Private and loopback addresses need --allow-private. A port range is not accepted.
One port from 1 to 65535.
How long to wait for this one connection, from 200 to 10000 milliseconds.
Result
Check one host and one port to see the protocol, the cipher and the chain.
- Address
- Protocol
- Cipher
- Trust
- Leaf expiry
- Time
Chain
| Subject | Issuer | Not before | Not after | SHA-256 |
|---|
On this page
TLS Certificate asks the local agent to open one TLS handshake to a host and port you type, then closes it without sending application data. The page shows the protocol, the cipher, whether the chain is trusted, when the leaf expires, and each certificate in the chain. The grant is tls.inspect, separate from http.request, icmp.trace, dns.lookup and tcp.connect. Pasted PEM parsing stays in the certificate tool.
Detailed Functionality
The agent resolves the name to the first address and applies the same destination rules as the HTTP client. Private and loopback addresses work only when the agent was started with --allow-private. Metadata, link-local and multicast addresses stay blocked, and the agent's own listening port is blocked. An untrusted or expired chain is still shown: the handshake signature is checked, and trust is a separate check against the bundled Mozilla roots. The agent does not fetch extra certificates and does not read a banner. A numeric range such as 80-443 is rejected. At most two checks run at once. The timeout stays in this browser. The host, the port and the chain do not.
Practical Examples
example.comport 443 shows the protocol, the cipher, the expiry and a trusted chain when the public roots accept it.- A local self-signed certificate shows a completed handshake with trust off, plus the leaf name and the expiry.
80-443in the host field is rejected. This is not a scan. A pasted PEM stays in the certificate tool.
How to Use This Tool
Start the local agent
Download the agent, start it, and copy the pairing code.
Pair TLS inspect
Paste the code and connect. The page asks for tls.inspect and keeps capabilities this browser already holds.
Check one port
Enter one host and one port, set the timeout, and press Check.
Read the chain
The page shows the protocol, the cipher, trust, the leaf expiry and the chain. Copy it as text. Reloading the page clears it.
Tips and Best Practices
- A refused connection, a timeout and a failed handshake are results. They are not a failed check.
- An untrusted chain is still a completed handshake. Trust is reported separately.
- One request is one host and one port. A range stays out of this tool.
- The published Windows download may be older than this page. TLS inspect needs an agent that advertises tls.inspect.