Tlsinspect is a single-purpose tool: you give it a hostname, it connects to that host over TLS, reads the certificate chain the server actually presents, and displays the results. No account, no sign-up, no data stored.
github.com). No protocol, no path, no port.That is all it does. It answers once when you ask — there is no monitoring, no scheduled re-checks, no alerts.
When a server sends its certificate, it should also send every intermediate certificate needed to build a trust path to a root CA. If an intermediate is missing, desktop browsers often work around it using cached copies — but mobile clients, API consumers, and fresh browser profiles do not have that cache. The connection fails, and the failure is invisible to anyone who only checked the expiry date. This is the single most common TLS configuration problem that causes a production outage.
The most common cause: your host is behind Cloudflare. The platform Tlsinspect runs on cannot open a TCP socket into Cloudflare's own network — this is a platform limitation, not a finding about your server. If you see "unreachable" for a host that loads fine in your browser, check whether it uses Cloudflare. Other possible causes include firewall rules that block traffic from our inspection droplet's IP range, or hosts that require Client Hello extensions our TLS library does not support.
No. Tlsinspect answers when you ask it — there is no scheduled monitoring, no alerts, no email sender, and no reminder system. If you need expiry monitoring, you will need a dedicated monitoring service. This is a known limitation of the current product (see the Known Limitations section below).
Tlsinspect reports exactly what the server presented at the time of the TLS handshake. If a field is absent in the certificate, the tool says it is absent — it never infers or fills in a typical value. The data is as accurate as the server's own configuration. If the server serves different certificates to different clients (e.g. via SNI-based load balancers), the result reflects what was served to this particular connection.
Not yet. A Pro plan with API access and unlimited inspections is planned but not available. There is no current API endpoint, no rate-limit bypass, and no bulk-inspection feature. Automated or frequent inspection of the Free tier may be rate-limited or blocked without notice. See the pricing page for details on the planned Pro tier.
No. The hostname is forwarded to our inspection backend to perform the TLS handshake, and no log of inspected hostnames is retained. We do not use cookies, analytics, or tracking scripts. See the privacy policy for full details.
Tlsinspect does not yet have a support mailbox or contact form. If you need help, have found a bug, or want to request a feature, the best way to reach the team is through the Tlsinspect project's issue tracker. Contact details are not yet available by email or phone.
Security vulnerabilities should also be reported through the issue tracker. Please use a responsible disclosure approach and allow time for a fix before public discussion.
Check the FAQ above — most common questions are answered here. If your question is about a specific hostname's inspection results, please include the exact hostname and any error message you saw so we can reproduce the issue.