HTTPS Inspector

HTTPS Inspector analyzes endpoint security posture by collecting TLS configuration data and HTTP response metadata to verify trust signals and security readiness. It targets web developers, security engineers, SREs, and SEO analysts who need objective evidence of certificate validity, protocol support, CA chain health, and header signals. Typical use cases include pre-deploy audits, incident response, and domain portfolio compliance where fast, repeatable checks reduce investigation time.

Core Logic & Features: The tool performs live TLS handshake analysis to capture TLS version, cipher suite, and certificate chain, then retrieves first-party response headers to assess security headers. It outputs structured results suitable for automation and dashboards. Required features: TLS version detection, certificate chain validation, hostname verification, expiration date, SANs, issuer, and header presence checks. Optional/advanced features: OCSP stapling status, certificate transparency data, HSTS, CSP, X-Content-Type-Options, and redirect behavior.

Inputs & Outputs: Required inputs include target URL or host, and optional port and protocol override. Outputs include TLS details (version, expiry, issuer, chain status), certificate metadata (subject, SANs), header signals (security headers present/absent), and a risk score. Formatting rules: dates ISO 8601, certificates in PEM-like fields, headers as key/value pairs, and a structured JSON for automation.

Algorithms & Calculations: Uses standard TLS client handshakes and certificate parsing per RFCs 2818/5246/8446, validates expiry and name match, assesses CVSS-like risk hints from TLS and headers, and computes a composite risk score. References include TLS version support, certificate trust chains, and common security header checks.
Error & Edge Cases: Handles expired certificates, untrusted roots, hostname mismatches, time skew, network timeouts, and redirects loops. When data is unavailable, it returns explicit flags (e.g., certificate_valid: false, tls_supported: false) without masking risk.

Industry/Region & Localization: Standards align with RFCs for TLS, X.509, and HTTP headers. Units and formats follow US English conventions; supports international domains and timezones; no regional licensing constraints.

Assumptions & Exclusions: Assumes outbound network access to target domains; does not access private/internal systems or credentials; not a vulnerability scanner and does not probe login endpoints or payloads.