FIELD GUIDE / THE HANDSHAKE · 5 MIN READ

Read a TLS Certificate Without Overclaiming.

A valid certificate is one part of a working HTTPS connection. It is not a rating of a company, an application or the safety of every page.

SSL in the Name, TLS in the Connection

“SSL certificate” remains a familiar name. Modern HTTPS uses TLS; this tool negotiates TLS 1.2 or 1.3. It does not attempt obsolete SSL versions or enumerate every protocol and cipher offered by the server.

Three Separate Questions

1. Does the hostname match? The name requested must be covered by the certificate’s identity rules. ABOUTSSL reports the hostname check from Node’s TLS implementation.
2. Are the dates valid? The VPS clock must fall between the certificate’s start and end times. Days remaining is rounded down, and a date close to expiry needs attention.
3. Does this checker trust the path? Node evaluates the connection against this service’s trust configuration. Another browser, operating system or private PKI may reach a different result.

Understand the Chain

The leaf identifies the website. Intermediates connect it toward a root the client must already trust independently. A server normally sends the leaf and relevant intermediates, not a root as a way of granting trust.

The chain shown here is the path exposed by the TLS library. It may include a root completed from local trust data; do not treat the list as a precise transcript of what the server sent. Revocation and Certificate Transparency are not evaluated.

Read the Connection Details

The reported TLS version and cipher are what this one connection negotiated. SNI tells the destination which hostname is being requested. A load balancer or CDN may present a different certificate from the origin behind it.

Scope and Timing Matter

The checker resolves public A and AAAA records, prefers one IPv4 address when available, and otherwise uses one IPv6 address. It pins that public address for the handshake. It does not test every address or region. Record the checked time and selected endpoint when comparing results.

A failed connection is not an invalid-certificate verdict. Routing, firewalls, rate limits and server configuration can prevent a handshake. Likewise, “checks passed” does not verify application security, renewal automation or the absence of phishing.

Inspect from Your Own Network

openssl s_client -connect aboutssl.info:443 -servername aboutssl.info -verify_hostname aboutssl.info -verify_return_error -showcerts

This connects directly to the named server. Review the verification result; -verify_return_error stops on verification errors. Press Ctrl+C when finished. Your local CA store and network path can differ from this VPS.