SSL / TLS

What it does: fetches the live TLS certificate and audits the connection — subject/issuer, validity dates and days remaining, the negotiated TLS protocol and cipher suite, key size, signature algorithm, SANs, and SHA-256/SHA-1 thumbprints. It flags weak/expiring configurations as ⚠ findings (expired or 30 days or less, pre-TLS-1.2, SHA-1/MD5 signature, RSA <2048, self-signed, a name that doesn't match the host, a chain that doesn't validate) and remembers each host's certificate so it can warn you when the cert CHANGES since you last looked.

Tip: add :port for non-443 services, e.g. mail.example.com:993.

Safe to run: yes — it accepts any certificate so it can inspect broken/expired/self-signed ones without connecting as a real client. Read-only.

Reading results: the top card is the answer at a glance — days left as one big number with the same bands as Cert fleet (OK above 30 days, RENEW SOON at 30 or less, URGENT at 7 or less / expired). Beside it: a 90-day gauge, the warning count, every name the certificate covers (its SANs) and the chain from this certificate up to the root. The full detail rows follow underneath. "Days remaining" near zero is a classic "it broke and nobody changed anything" outage. A "cert CHANGED since last seen" flag means the certificate was reissued/rotated — or, rarely, the connection is being intercepted; confirm the change was expected.

Cert fleet: the "Cert fleet ▸" button (top-right) keeps a saved list of every host[:port] whose certificate you care about — public sites, VPN and firewall portals, switch and printer web UIs. "Check all" inspects them 4 at a time with the same inspector and lists subject + SANs, issuer, not-after date, days left (≤7 red, ≤30 amber), whether the chain validates, and when each was last checked, most urgent first. When a cert crosses ≤30 or ≤7 days since its last successful check the row is highlighted and an Activity line is written (a failed check in between doesn't reset that — the row keeps showing the last good days-left). It checks when you press Check all — it doesn't run on a schedule, so open it regularly. Export CSV writes the table to your exports folder. The list is remembered between sessions (stored locally, nothing is sent anywhere but the TLS handshake to each host you listed).