TLS inspector.
Open a TLS connection to a host and read back what it presents: the full certificate chain, expiry dates, the protocol and cipher that were negotiated, and whether legacy versions are still switched on.
About this tool
This server opens a TCP connection to the host and port you give it, performs a TLS handshake using the SNI name (the host by default), and reports what the server sent back. The chain is then verified against this machine's root store, and the hostname is checked against the leaf's subject alternative names. Four extra short handshakes probe whether the server accepts TLS 1.0 through 1.3 individually.
Useful for: catching certificates about to expire, checking a renewal actually deployed to every edge, confirming an intermediate is being served (a missing one is the usual cause of "works in Chrome, fails in curl"), verifying a load balancer speaks TLS 1.3 and HTTP/2 via ALPN, and confirming legacy protocols are switched off before an audit.
Setting a different SNI is handy for testing a new certificate on a shared IP before DNS is moved, or for checking the default certificate a server presents when no name matches. Only public hosts can be inspected, and nothing about the connection is stored.
From a terminal: curl "kirkdiamond.com/tools/tls?host=example.com" or add &format=json.