SSL/TLS Certificate Checker

Check a public domain's HTTPS response, redirects, HSTS header, Certificate Transparency metadata, and DANE/TLSA signal.

Part of AppSec Santa's free website security scanners — five browser-accessible tools, no signup.

HTTPS & Browser Policy Signals

Observe public HTTP and HTTPS responses, including the HSTS policy returned by the HTTPS endpoint.

HTTPS availability and response check
HTTP to HTTPS redirect verification
HSTS header parsing (max-age, includeSubDomains, preload token)
Direct HTTPS-to-HTTP redirect check

🔒

HTTPS

Public HTTPS response observed

→

HTTP Redirect

Direct HTTP response behavior

🛡

HSTS

Returned browser policy

▼

Redirect Check

Flags a direct redirect to HTTP

Certificate Transparency Metadata

Review a matching Certificate Transparency entry. The data does not identify or validate the certificate presented by the live endpoint.

Validity dates from the selected CT entry
Entries returned by queried CT sources
Issuer metadata from the selected CT entry
Names listed in the selected CT entry

Example Results

HTTPS Available +15

HSTS Configuration +15

CT Certificate Dates Info

CT Issuer Metadata Info

Selected DNS and Redirect Signals

Check for TLSA records and the resolver's DNSSEC authentication signal. The checker does not compare TLSA association data with the live certificate.

DANE/TLSA DNS record detection
Resolver DNSSEC authentication signal
Direct HTTPS-to-HTTP redirect check
Unknown results kept separate from passes

CT Entry Details

; CT Entry Metadata
Issuer:     Let's Encrypt (R3)
Valid From: 2025-12-01
Valid To:   2026-03-01
Days Left:  21 days
CN:         example.com

; Names in CT Entry
example.com
*.example.com

; DANE/TLSA
No TLSA records found

HTTPS Configuration Check: —

Score: 0 / 100

Scan Time: —

Tests Passed: 0 / 0

Test	Score	Reason	Recommendation

What This SSL/TLS Checker Measures

Correctly configured TLS can provide confidentiality and integrity between clients and servers. This checker observes public HTTP and HTTPS responses, the returned HSTS header, Certificate Transparency metadata, and one TLSA lookup. It does not test protocol versions, cipher suites, the live certificate chain, hostname coverage, revocation, client compatibility, or end-to-end application security.

TLS

HTTPS Available

+15 / -20

A successful HTTPS fetch shows that the public endpoint returned a response over HTTPS. This check does not expose the negotiated TLS version, cipher suite, certificate chain, or hostname validation details.

Reference: RFC 8446 (TLS 1.3), RFC 9325

301

HTTP→HTTPS Redirect

+10 / -10

The checker sends one HTTP request without following redirects and inspects its direct status and Location header. It does not analyze a multi-step redirect chain.

Reference: RFC 7231 §6.4.2

STS

HSTS Configuration

+15 / -15

HSTS tells supporting browsers to use HTTPS after they receive the policy, while preload lists can cover the first visit. A preload token in the header does not prove list membership; preload services apply separate eligibility and submission requirements.

Reference: RFC 6797 · hstspreload.org

EXP

CT Certificate Dates

0 / 0

The displayed validity dates come from the most recent currently valid matching CT entry selected by the checker. They are informational and unscored because that entry may not be the certificate served by the live endpoint.

Reference: RFC 8555 (ACME)

Certificate Transparency

+5 / 0

Certificate Transparency uses public, append-only logs for submitted certificate records. Monitoring can surface unexpected issuance, but results from these queries do not identify the certificate currently served by the endpoint, and an empty result is not definitive.

Reference: RFC 6962 · certificate.transparency.dev

CT Issuer Metadata

0 / 0

The issuer shown here comes from the selected CT entry. The checker does not validate the live certificate chain or compare it with browser and operating-system trust stores.

Reference: Mozilla CA Certificate Policy

DANE/TLSA Records

+5 / 0

DANE uses DNSSEC-authenticated TLSA records to associate a service with a certificate or public key. This checker queries _443._tcp, checks the resolver's authentication signal, and does not compare the association data with the live certificate.

Reference: RFC 6698, RFC 7671

HTTPS→HTTP Redirect Check

+10 / -15

The checker sends one HTTPS request without following redirects and flags a direct redirect whose Location begins with HTTP. It does not analyze later hops, mixed content, or broader downgrade resistance.

Reference: RFC 9325 §3.1

AppSec Santa Configuration Score

This local heuristic starts at 100 and applies modifiers from eight observable signals before mapping the result to an A+–F label. It is not a TLS security rating or an external standard. CT metadata comes from crt.sh, with Cert Spotter used as a fallback.

Test	Pass	Fail	Weight
HTTPS Available	+15	-20	Critical
HTTP→HTTPS Redirect	+10	-10	High
HSTS Configuration	+15	-15	High
CT Certificate Dates	0	0	Informational
Certificate Transparency	+5	0	CT signal
CT Issuer Metadata	0	0	Informational
DANE/TLSA Records	+5	0	Bonus signal
HTTPS→HTTP Redirect Check	+10	-15	High

Standards & References

These sources explain the underlying protocols and configuration context. This checker does not implement full conformance testing for those standards.

TLS 1.3 RFC 8446 — Transport Layer Security 1.3

TLS Best RFC 9325 — TLS/DTLS Recommendations

HSTS RFC 6797 — HTTP Strict Transport Security

DANE RFC 6698, 7671 — DANE/TLSA

CT RFC 6962 — Certificate Transparency

ACME RFC 8555 — Automated Certificate Management

OWASP TLS Cheat Sheet

CT Data CT metadata from crt.sh, with Cert Spotter as fallback

Check Your Other Security Layers Too

SSL/TLS is one layer. HTTP security headers and DNS controls provide additional signals. These checks add configuration evidence but do not provide a complete security assessment.

Check Security Headers Check DNS Security