{"id":13544,"date":"2026-09-02T13:14:13","date_gmt":"2026-09-02T11:14:13","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/toolbox\/tls-certificate-handshake-inspector\/"},"modified":"2026-09-02T13:14:13","modified_gmt":"2026-09-02T11:14:13","slug":"tls-certificate-handshake-inspector","status":"publish","type":"page","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/tls-certificate-handshake-inspector\/","title":{"rendered":"TLS Certificate &#038; Handshake Inspector"},"content":{"rendered":"<div class=\"gtm-analyser-container\" style=\"background: var(--bg-panel, #1e1e24); padding: 25px; border-radius: 8px; border: 1px solid var(--border, #2a2a35);\">\n<p style=\"color: var(--text-secondary, #a0a0b0); margin-bottom: 20px;\">The padlock in the browser says only that something verified. This opens a TLS connection to the host from this server, with the host name as SNI, and reads the certificate, its chain and validity, the key, the negotiated protocol and cipher, and then tries TLS 1.0, 1.1, 1.2 and 1.3 one by one to see which the server accepts. No HTTP request is sent.<\/p>\n<div style=\"margin-bottom: 14px;\">\n        <label for=\"tc-host\" style=\"color: var(--text-secondary, #a0a0b0); display: block; font-size: 0.85rem; margin-bottom: 5px;\">Host name (optionally with :port, 443 or 8443)<\/label><br \/>\n        <input id=\"tc-host\" type=\"text\" value=\"example.com\" class=\"form-control\" style=\"width: 100%; padding: 10px; background: var(--bg-body, #14141a); border: 1px solid var(--border, #2a2a35); color: var(--text-primary, #e8e8ee); border-radius: 6px; box-sizing: border-box; font-family: monospace;\">\n    <\/div>\n<p style=\"color: var(--text-secondary, #a0a0b0); font-size: 0.82rem; margin-bottom: 16px;\">Up to six TLS handshakes are opened from this server to the host entered, none of them followed by an HTTP request. Hosts in private, loopback and link-local networks are refused. The query is protected by reCAPTCHA v3; the calling IP address and the target are stored for one hour to limit the rate.<\/p>\n<p>    <button id=\"tc-btn\" class=\"button\" style=\"background: var(--accent, #7ee787); color: var(--on-accent, #0b1114); border: none; padding: 12px 24px; border-radius: 6px; font-weight: 700; cursor: pointer;\">Inspect the certificate<\/button><\/p>\n<div id=\"tc-ausgabe\" style=\"margin-top: 22px;\"><\/div>\n<p style=\"color: var(--text-secondary, #a0a0b0); font-size: 0.8rem; margin: 24px 0 0;\">Limits worth knowing: only one of the resolved addresses is tested, which matters behind a load balancer with differing certificates; OCSP stapling and certificate transparency are not read; whether TLS 1.0 and 1.1 are accepted can only be judged when this server&#039;s own OpenSSL still speaks them, otherwise they show as not measurable.<\/p>\n<\/div>\n<p><script>\n(function () {\n    'use strict';<\/p>\n<p>    const T = {\"einleitung\":\"The padlock in the browser says only that something verified. This opens a TLS connection to the host from this server, with the host name as SNI, and reads the certificate, its chain and validity, the key, the negotiated protocol and cipher, and then tries TLS 1.0, 1.1, 1.2 and 1.3 one by one to see which the server accepts. No HTTP request is sent.\",\"label_host\":\"Host name (optionally with :port, 443 or 8443)\",\"datenschutz\":\"Up to six TLS handshakes are opened from this server to the host entered, none of them followed by an HTTP request. Hosts in private, loopback and link-local networks are refused. The query is protected by reCAPTCHA v3; the calling IP address and the target are stored for one hour to limit the rate.\",\"knopf\":\"Inspect the certificate\",\"laeuft\":\"Opening the handshakes...\",\"grenze\":\"Limits worth knowing: only one of the resolved addresses is tested, which matters behind a load balancer with differing certificates; OCSP stapling and certificate transparency are not read; whether TLS 1.0 and 1.1 are accepted can only be judged when this server\\u0027s own OpenSSL still speaks them, otherwise they show as not measurable.\",\"h_verbindung\":\"Connection\",\"zeile_host\":\"Host\",\"zeile_ip\":\"Resolved addresses\",\"zeile_protokoll\":\"Negotiated protocol\",\"zeile_cipher\":\"Cipher\",\"zeile_verifiziert\":\"Chain verifies\",\"zeile_dauer\":\"Took\",\"zeile_limit\":\"Checks left this hour\",\"h_zertifikat\":\"Certificate\",\"zeile_cn\":\"Common name\",\"zeile_sans\":\"Subject alternative names\",\"zeile_aussteller\":\"Issuer\",\"zeile_gueltig\":\"Valid\",\"zeile_laufzeit\":\"Lifetime\",\"zeile_schluessel\":\"Key\",\"zeile_signatur\":\"Signature\",\"zeile_seriennummer\":\"Serial\",\"rest_tage\":\"{tage} days left\",\"einheit_tage\":\"days\",\"h_kette\":\"Chain as sent by the server\",\"spalte_nr\":\"#\",\"spalte_subject\":\"Subject\",\"spalte_issuer\":\"Issuer\",\"spalte_bis\":\"Expires\",\"h_versionen\":\"TLS versions the server accepts\",\"version_angenommen\":\"accepted\",\"version_abgelehnt\":\"refused\",\"version_nicht_messbar\":\"not measurable from here\",\"h_befunde\":\"Findings\",\"stufe_hoch\":\"High\",\"stufe_mittel\":\"Medium\",\"stufe_niedrig\":\"Low\",\"stufe_info\":\"Information\",\"stufe_gut\":\"In order\",\"keine_befunde\":\"Nothing to report.\",\"urteil_gut\":\"The certificate and the handshake are in order.\",\"urteil_warnung\":\"Works today, with something that deserves attention.\",\"urteil_kritisch\":\"At least one finding breaks trust or will break it soon.\",\"ja\":\"yes\",\"nein\":\"no\",\"wert_keine\":\"none\",\"fehler_kein_token\":\"The check could not be started because reCAPTCHA did not load.\",\"fehler_captcha\":\"reCAPTCHA classified the request as automated. Reloading the page normally helps.\",\"fehler_zu_viele\":\"The limit of {limit} checks per hour for this address has been reached.\",\"fehler_adresse\":\"That host cannot be used.\",\"fehler_zaehler\":\"The rate counter is unavailable, so nothing was checked.\",\"fehler_pruefdienst\":\"The reCAPTCHA service could not be reached.\",\"fehler_aufbau\":\"The service is not configured correctly. The fault is on this side.\",\"fehler_eingabe\":\"The request could not be read.\",\"fehler_methode\":\"Wrong request method.\",\"fehler_netz\":\"The service could not be reached.\",\"fehler_antwort\":\"The answer could not be read.\",\"fehler_unbekannt\":\"Something went wrong that has no message of its own.\",\"grund_leer\":\"Nothing was entered.\",\"grund_zu_lang\":\"The input is too long.\",\"grund_unlesbar\":\"It does not parse as a host name.\",\"grund_schema\":\"Only https hosts are inspected.\",\"grund_benutzerinfo\":\"Inputs with credentials in them are refused.\",\"grund_kein_punkt\":\"The host name needs at least one dot.\",\"grund_hostform\":\"Enter a host name, not an IP address.\",\"grund_port\":\"Only ports 443 and 8443 are inspected.\",\"grund_gesperrter_bereich\":\"That host resolves into a private or reserved network. Those are never contacted.\",\"grund_kein_dns\":\"The host name does not resolve.\",\"befund_keine_verbindung\":\"No TLS connection possible || The server did not complete a handshake on this port: {fehler}. Either nothing listens there, a firewall drops the connection, or the server speaks no TLS version this client offers.\",\"befund_selbstsigniert\":\"Self-signed certificate || Issuer and subject are the same. Browsers show a full-page warning; only a certificate from a public CA (Let\\u0027s Encrypt is free) removes it.\",\"befund_kette_unvollstaendig\":\"Chain does not verify: intermediate certificate missing || The server sends the leaf without its intermediate ({fehler}). Some browsers fetch the missing link themselves, most API clients and curl do not. Install the full chain file (fullchain.pem) instead of the certificate alone.\",\"befund_verifikation_fehlgeschlagen\":\"Chain does not verify || Verification failed with: {fehler}. The details above show what the server sent.\",\"befund_kette_ok\":\"Chain verifies ({n} certificates) || The certificates sent by the server lead to a trusted root.\",\"befund_zert_abgelaufen\":\"Certificate expired {tage} day(s) ago (on {datum}) || Every client refuses the connection. Renewal, and a look at why the automatic renewal did not run.\",\"befund_zert_noch_nicht_gueltig\":\"Certificate not valid before {datum} || The validity period starts in the future; a wrong server clock is the usual cause.\",\"befund_zert_laeuft_ab_bald\":\"Certificate expires in {tage} day(s), on {datum} || Less than two weeks. With Let\\u0027s Encrypt this normally means the renewal job (certbot, acme.sh) has been failing; the renewal log shows why.\",\"befund_zert_laeuft_ab\":\"Certificate expires in {tage} days, on {datum} || Within a month. Automated renewals usually run 30 days before expiry, so this is the moment to check the job.\",\"befund_zert_gueltig\":\"Certificate valid for another {tage} days (until {datum}) || Expiry is not a concern right now.\",\"befund_laufzeit_lang\":\"Lifetime of {tage} days || Certificates issued with more than 398 days of validity are rejected by Safari and Chrome. Publicly trusted CAs no longer issue them; this one is private or old.\",\"befund_kein_san\":\"No subject alternative names, only a common name ({cn}) || Modern browsers ignore the common name and match against the SAN list only. Without SANs the certificate does not match any host.\",\"befund_hostname_passt\":\"Host name {host} is covered || The name matches an entry in the certificate.\",\"befund_hostname_passt_nicht\":\"Host name {host} is not covered || The certificate names {namen}. Browsers refuse the connection with a name mismatch; the certificate belongs to another host or the wildcard covers a different level.\",\"befund_platzhalter\":\"Wildcard certificate ({name}) || A wildcard covers exactly one label: *.example.com matches www.example.com but neither example.com nor a.b.example.com.\",\"befund_www_fehlt\":\"{name} is not in the certificate || The www variant is not covered, so the usual redirect from www to the apex fails before it starts. Adding the second name costs nothing.\",\"befund_apex_fehlt\":\"{name} is not in the certificate || The bare domain is not covered; whoever types it without www gets a warning before any redirect can happen.\",\"befund_schluessel_schwach\":\"Weak key: {art} {bits} bit || RSA below 2048 bit is rejected by current browsers and has been considered breakable for years. A new key is needed, not just a new certificate.\",\"befund_schluessel_ok\":\"Key: {art} {bits} bit || RSA from 2048 bit and ECDSA P-256 or P-384 are current practice.\",\"befund_signatur_sha1\":\"SHA-1 signature ({algorithmus}) || SHA-1 signatures have been rejected by browsers since 2017. A reissue with SHA-256 is needed.\",\"befund_signatur_md5\":\"MD5 signature ({algorithmus}) || MD5 is broken; no client accepts this.\",\"befund_protokoll_alt\":\"Connection negotiated {protokoll} || With TLS 1.0 or 1.1 as the best the server offers, current browsers refuse to connect. The server configuration needs TLS 1.2 at least.\",\"befund_protokoll_tls13\":\"Connection negotiated {protokoll} || The current version, with a one-round-trip handshake and only forward-secret ciphers.\",\"befund_protokoll_tls12\":\"Connection negotiated {protokoll} || TLS 1.2 is fine; TLS 1.3 would save a round trip and is available in every current server.\",\"befund_cipher_schwach\":\"Weak cipher: {cipher} || RC4, 3DES, export and NULL ciphers are broken or deprecated. Restrict the server\\u0027s cipher list to modern AEAD suites.\",\"befund_cipher_ohne_pfs\":\"Cipher without forward secrecy: {cipher} || A static RSA key exchange means a leaked private key decrypts recorded traffic retroactively. Prefer ECDHE suites in the server\\u0027s cipher order.\",\"befund_tls_alt_aktiv\":\"TLS {versionen} still accepted || Old versions are only used by clients that cannot do better, and they are the ones attackers target. Disable them in the server configuration unless a known legacy client needs them.\",\"befund_tls13_fehlt\":\"TLS 1.3 not offered || The server accepts 1.2 only. Every current web server supports 1.3; enabling it saves a round trip per connection.\",\"befund_tls12_13_fehlen\":\"Neither TLS 1.2 nor 1.3 accepted || Current browsers cannot connect at all.\",\"befund_kette_nur_blatt\":\"Only the leaf certificate was sent || Verification still succeeded because this server had the intermediate cached. Clients without that cache will fail; send the full chain.\",\"befund_aussteller\":\"Issued by {aussteller} || The certificate authority named in the certificate.\"};<\/p>\n<p>    var ENDPUNKT = '\/lw-tlscheck.php';\n    var SITEKEY = '6LcrPkEtAAAAAPo1QCOf-IIM2fCL0UfdJz4y2iSY';\n    var STUFEN = ['hoch', 'mittel', 'niedrig', 'info', 'gut'];\n    var VERSIONEN = ['1.0', '1.1', '1.2', '1.3'];<\/p>\n<p>    function liste(w) { return Array.isArray(w) ? w : []; }\n    function zahl(w) { return (typeof w === 'number' && isFinite(w)) ? w : null; }\n    function text(schluessel, daten) {\n        var t = T[schluessel];\n        if (typeof t !== 'string') { return null; }\n        return t.replace(\/\\{([a-z_]+)\\}\/g, function (m, k) {\n            return (daten && daten[k] !== undefined && daten[k] !== null) ? String(daten[k]) : m;\n        });\n    }<\/p>\n<p>    function bewerten(antwort) {\n        var a = antwort || {};\n        if (a.fehler) { return { fehler: a.fehler, grund: a.grund || null, limit: zahl(a.limit) }; }\n        var befunde = liste(a.befunde).map(function (f) {\n            return { key: String(f.key || ''), stufe: STUFEN.indexOf(f.stufe) === -1 ? 'info' : f.stufe, daten: (f.daten && typeof f.daten === 'object') ? f.daten : {} };\n        });\n        var gruppen = {};\n        STUFEN.forEach(function (s) { gruppen[s] = befunde.filter(function (f) { return f.stufe === s; }); });\n        var z = (a.zert && typeof a.zert === 'object') ? a.zert : null;\n        var versionen = {};\n        VERSIONEN.forEach(function (v) { versionen[v] = (a.versionen && a.versionen[v]) ? String(a.versionen[v]) : 'nicht_messbar'; });\n        return {\n            fehler: null, host: a.host || '', port: zahl(a.port), ip: a.ip || '', ips: liste(a.ips),\n            urteil: (a.urteil === 'gut' || a.urteil === 'warnung' || a.urteil === 'kritisch') ? a.urteil : 'kritisch',\n            verifiziert: !!a.verifiziert, verbindungsfehler: a.verbindungsfehler || null,\n            protokoll: a.protokoll || null, cipher: a.cipher || null, cipherBits: zahl(a.cipher_bits),\n            zert: z ? { cn: z.cn || '', sans: liste(z.sans), aussteller: z.aussteller || '', von: z.von || null, bis: z.bis || null,\n                        tage: zahl(z.tage), laufzeit: zahl(z.laufzeit_tage), signatur: z.signatur || null, seriennummer: z.seriennummer || null,\n                        ocsp: !!z.ocsp, schluessel: (z.schluessel && typeof z.schluessel === 'object') ? z.schluessel : null } : null,\n            kette: liste(a.kette), versionen: versionen, befunde: befunde, gruppen: gruppen,\n            dauer: zahl(a.dauer_ms), limitRest: zahl(a.limit_rest)\n        };\n    }<\/p>\n<p>    function skriptLaden() {\n        return new Promise(function (auf) {\n            if (window.grecaptcha) { auf(true); return; }\n            var s = document.createElement('script');\n            s.src = 'https:\/\/www.google.com\/recaptcha\/api.js?render=' + SITEKEY;\n            s.onload = function () { auf(true); }; s.onerror = function () { auf(false); };\n            document.head.appendChild(s);\n            setTimeout(function () { auf(!!window.grecaptcha); }, 8000);\n        });\n    }\n    function tokenHolen() {\n        return skriptLaden().then(function (da) {\n            if (!da || !window.grecaptcha || !window.grecaptcha.ready) { return null; }\n            return new Promise(function (auf) {\n                var fertig = false;\n                function einmal(w) { if (!fertig) { fertig = true; auf(w); } }\n                setTimeout(function () { einmal(null); }, 12000);\n                try {\n                    window.grecaptcha.ready(function () {\n                        if (fertig) { return; }\n                        if (!window.grecaptcha.execute) { einmal(null); return; }\n                        window.grecaptcha.execute(SITEKEY, { action: 'tlscheck' }).then(function (t) { einmal(t || null); }, function () { einmal(null); });\n                    });\n                } catch (e) { einmal(null); }\n            });\n        }, function () { return null; });\n    }\n    function abfragen(host) {\n        return tokenHolen().then(function (token) {\n            return fetch(ENDPUNKT, { method: 'POST', headers: { 'Content-Type': 'application\/json' }, body: JSON.stringify({ host: host, token: token || '' }) })\n                .then(function (r) { return r.json().then(function (j) { return j; }, function () { return { fehler: 'antwort' }; }); }, function () { return { fehler: 'netz' }; });\n        });\n    }<\/p>\n<p>    window.LW_TEST = window.LW_TEST || {};\n    window.LW_TEST.TC = { bewerten: bewerten, darstellen: null, text: text, ENDPUNKT: ENDPUNKT, STUFEN: STUFEN, VERSIONEN: VERSIONEN, T: T };<\/p>\n<p>    var btn = document.getElementById('tc-btn');\n    var out = document.getElementById('tc-ausgabe');\n    if (!btn || !out) { return; }<\/p>\n<p>    function el(tag, stil, txt) { var e = document.createElement(tag); if (stil) { e.setAttribute('style', stil); } if (txt !== undefined && txt !== null) { e.textContent = txt; } return e; }\n    function wert(id) { var e = document.getElementById(id); return e ? e.value : ''; }\n    var UEBERSCHRIFT = 'font-family: \"Nunito Sans\", sans-serif; font-weight: 700; color: var(--text-primary, #e8e8ee); font-size: 0.95rem; margin: 22px 0 8px;';\n    var ZELLE = 'padding: 5px 12px 5px 0; color: var(--text-secondary, #a0a0b0); font-size: 0.87rem;';\n    var ZELLE_WERT = 'padding: 5px 12px 5px 0; color: var(--text-primary, #e8e8ee); font-size: 0.87rem; font-family: monospace; word-break: break-all;';\n    var KASTEN = 'background: var(--bg-body, #14141a); border: 1px solid var(--border, #2a2a35); border-radius: 8px; padding: 14px 16px; margin: 0 0 10px;';\n    var GUT = ' color: #7ee787;', WARN = ' color: #ffa94d;', ROT = ' color: #ff7b72;', GRAU = ' color: #8a8a99;';\n    var FARBEN = { hoch: '#ff7b72', mittel: '#ffa94d', niedrig: '#e3b341', info: '#8a8a99', gut: '#7ee787' };\n    var URTEIL = { gut: GUT, warnung: WARN, kritisch: ROT };\n    function gitter(sp) { return el('div', 'display: grid; grid-template-columns: ' + sp + '; gap: 0 18px; align-items: baseline;'); }\n    function paar(g, n, w, stil) { g.appendChild(el('div', ZELLE, n)); g.appendChild(el('div', ZELLE_WERT + (stil || ''), w)); }<\/p>\n<p>    function darstellen(b, ziel) {\n        ziel.innerHTML = '';\n        if (b.fehler) {\n            var txt = T['fehler_' + b.fehler] || T.fehler_unbekannt;\n            if (b.grund && T['grund_' + b.grund]) { txt = txt + ' ' + T['grund_' + b.grund]; }\n            if (b.limit !== null) { txt = txt.replace('{limit}', String(b.limit)); }\n            ziel.appendChild(el('p', ZELLE + WARN + ' margin: 0;', txt));\n            return;\n        }\n        ziel.appendChild(el('div', 'font-size: 1.05rem; font-weight: 700; margin: 0 0 12px;' + URTEIL[b.urteil], T['urteil_' + b.urteil]));<\/p>\n<p>        ziel.appendChild(el('div', UEBERSCHRIFT, T.h_verbindung));\n        var g = gitter('auto auto');\n        paar(g, T.zeile_host, b.host + (b.port && b.port !== 443 ? ':' + b.port : ''));\n        paar(g, T.zeile_ip, b.ips.length ? b.ips.join(', ') : b.ip, GRAU);\n        if (b.protokoll) { paar(g, T.zeile_protokoll, b.protokoll, \/1\\.3\/.test(b.protokoll) ? GUT : (\/1\\.2\/.test(b.protokoll) ? '' : ROT)); }\n        if (b.cipher) { paar(g, T.zeile_cipher, b.cipher + (b.cipherBits ? ' (' + b.cipherBits + ' bit)' : ''), GRAU); }\n        paar(g, T.zeile_verifiziert, b.verifiziert ? T.ja : T.nein + (b.verbindungsfehler ? ' \u2013 ' + b.verbindungsfehler : ''), b.verifiziert ? GUT : ROT);\n        if (b.dauer !== null) { paar(g, T.zeile_dauer, b.dauer + ' ms', GRAU); }\n        if (b.limitRest !== null) { paar(g, T.zeile_limit, String(b.limitRest), GRAU); }\n        ziel.appendChild(g);<\/p>\n<p>        if (b.zert) {\n            ziel.appendChild(el('div', UEBERSCHRIFT, T.h_zertifikat));\n            var gz = gitter('auto auto');\n            paar(gz, T.zeile_cn, b.zert.cn || '-');\n            paar(gz, T.zeile_sans, b.zert.sans.length ? b.zert.sans.join(', ') : T.wert_keine, b.zert.sans.length ? '' : WARN);\n            paar(gz, T.zeile_aussteller, b.zert.aussteller || '-', GRAU);\n            paar(gz, T.zeile_gueltig, (b.zert.von || '?') + ' \u2192 ' + (b.zert.bis || '?') + (b.zert.tage !== null ? '  (' + text('rest_tage', { tage: b.zert.tage }) + ')' : ''),\n                b.zert.tage === null ? '' : (b.zert.tage < 14 ? ROT : (b.zert.tage < 30 ? WARN : GUT)));\n            if (b.zert.laufzeit !== null) { paar(gz, T.zeile_laufzeit, b.zert.laufzeit + ' ' + T.einheit_tage, GRAU); }\n            if (b.zert.schluessel) {\n                var s = b.zert.schluessel;\n                paar(gz, T.zeile_schluessel, (s.kurve ? 'ECDSA ' + s.kurve : 'RSA') + ' ' + s.bits + ' bit', GRAU);\n            }\n            if (b.zert.signatur) { paar(gz, T.zeile_signatur, b.zert.signatur, GRAU); }\n            paar(gz, 'OCSP', b.zert.ocsp ? T.ja : T.nein, GRAU);\n            if (b.zert.seriennummer) { paar(gz, T.zeile_seriennummer, b.zert.seriennummer, GRAU); }\n            ziel.appendChild(gz);\n        }\n\n        if (b.kette.length) {\n            ziel.appendChild(el('div', UEBERSCHRIFT, T.h_kette));\n            var gk = gitter('auto auto auto auto');\n            [T.spalte_nr, T.spalte_subject, T.spalte_issuer, T.spalte_bis].forEach(function (s) { gk.appendChild(el('div', ZELLE + ' font-weight: 700; color: var(--text-primary, #e8e8ee);', s)); });\n            b.kette.forEach(function (k, i) {\n                gk.appendChild(el('div', ZELLE, String(i + 1) + (k.ca ? ' (CA)' : '')));\n                gk.appendChild(el('div', ZELLE_WERT, k.subject || '?'));\n                gk.appendChild(el('div', ZELLE_WERT + GRAU, k.issuer || '?'));\n                gk.appendChild(el('div', ZELLE_WERT + GRAU, k.bis || '-'));\n            });\n            ziel.appendChild(gk);\n        }\n\n        ziel.appendChild(el('div', UEBERSCHRIFT, T.h_versionen));\n        var gv = gitter('auto auto');\n        VERSIONEN.forEach(function (v) {\n            var w = b.versionen[v];\n            var stil = w === 'angenommen' ? ((v === '1.0' || v === '1.1') ? WARN : GUT) : (w === 'abgelehnt' ? ((v === '1.2' || v === '1.3') ? WARN : GUT) : GRAU);\n            paar(gv, 'TLS ' + v, T['version_' + w] || w, stil);\n        });\n        ziel.appendChild(gv);\n\n        ziel.appendChild(el('div', UEBERSCHRIFT, T.h_befunde));\n        var irgendwas = false;\n        STUFEN.forEach(function (s) {\n            var gr = b.gruppen[s];\n            if (!gr.length) { return; }\n            irgendwas = true;\n            ziel.appendChild(el('div', 'font-weight: 700; font-size: 0.82rem; text-transform: uppercase; letter-spacing: 0.5px; margin: 14px 0 6px; color: ' + FARBEN[s] + ';', T['stufe_' + s] + ' (' + gr.length + ')'));\n            gr.forEach(function (f) {\n                var k = el('div', KASTEN + ' border-left: 3px solid ' + FARBEN[s] + ';');\n                var t = text('befund_' + f.key, f.daten) || f.key;\n                var teile = t.split(' || ');\n                k.appendChild(el('div', 'color: var(--text-primary, #e8e8ee); font-size: 0.9rem; font-weight: 700;', teile[0]));\n                if (teile[1]) { k.appendChild(el('div', ZELLE + ' padding: 6px 0 0; line-height: 1.55;', teile[1])); }\n                ziel.appendChild(k);\n            });\n        });\n        if (!irgendwas) { ziel.appendChild(el('p', ZELLE + ' margin: 0;', T.keine_befunde)); }\n    }\n    window.LW_TEST.TC.darstellen = darstellen;\n\n    var laeuft = false;\n    btn.addEventListener('click', function () {\n        if (laeuft) { return; }\n        laeuft = true; btn.disabled = true;\n        out.innerHTML = '';\n        out.appendChild(el('p', ZELLE + GRAU + ' margin: 0;', T.laeuft));\n        abfragen(wert('tc-host')).then(function (a) { darstellen(bewerten(a), out); laeuft = false; btn.disabled = false; },\n            function () { darstellen(bewerten({ fehler: 'netz' }), out); laeuft = false; btn.disabled = false; });\n    });\n})();\n<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Opens a TLS connection to a host and reads what the browser never shows in full: certificate names and expiry, the chain and whether it verifies, key and signature, the negotiated protocol and cipher, and which TLS versions the server still accepts.<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":38,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"template-tool-base.php","meta":{"footnotes":""},"tags":[91144,91243,91115],"class_list":["post-13544","page","type-page","status-publish","hentry","tag-devops","tag-networking","tag-web-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>TLS Certificate &amp; Handshake Inspector - Lukas Wojcik - Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/tls-certificate-handshake-inspector\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"TLS Certificate &amp; Handshake Inspector - Lukas Wojcik - Blog\" \/>\n<meta property=\"og:description\" content=\"Opens a TLS connection to a host and reads what the browser never shows in full: certificate names and expiry, the chain and whether it verifies, key and signature, the negotiated protocol and cipher, and which TLS versions the server still accepts.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/tls-certificate-handshake-inspector\/\" \/>\n<meta property=\"og:site_name\" content=\"Lukas Wojcik - Blog\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/og-default.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/tls-certificate-handshake-inspector\\\/\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/tls-certificate-handshake-inspector\\\/\",\"name\":\"TLS Certificate & Handshake Inspector - Lukas Wojcik - Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\"},\"datePublished\":\"2026-09-02T11:14:13+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/tls-certificate-handshake-inspector\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/tls-certificate-handshake-inspector\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/tls-certificate-handshake-inspector\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Toolbox\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"TLS Certificate &#038; Handshake Inspector\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\",\"name\":\"Lukas Wojcik - Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\",\"name\":\"luky\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"width\":424,\"height\":636,\"caption\":\"luky\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\"},\"sameAs\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"TLS Certificate & Handshake Inspector - Lukas Wojcik - Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/tls-certificate-handshake-inspector\/","og_locale":"en_US","og_type":"article","og_title":"TLS Certificate & Handshake Inspector - Lukas Wojcik - Blog","og_description":"Opens a TLS connection to a host and reads what the browser never shows in full: certificate names and expiry, the chain and whether it verifies, key and signature, the negotiated protocol and cipher, and which TLS versions the server still accepts.","og_url":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/tls-certificate-handshake-inspector\/","og_site_name":"Lukas Wojcik - Blog","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/og-default.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/tls-certificate-handshake-inspector\/","url":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/tls-certificate-handshake-inspector\/","name":"TLS Certificate & Handshake Inspector - Lukas Wojcik - Blog","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#website"},"datePublished":"2026-09-02T11:14:13+00:00","breadcrumb":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/tls-certificate-handshake-inspector\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/tls-certificate-handshake-inspector\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/tls-certificate-handshake-inspector\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.lukaswojcik.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Toolbox","item":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/"},{"@type":"ListItem","position":3,"name":"TLS Certificate &#038; Handshake Inspector"}]},{"@type":"WebSite","@id":"https:\/\/www.lukaswojcik.com\/blog\/#website","url":"https:\/\/www.lukaswojcik.com\/blog\/","name":"Lukas Wojcik - Blog","description":"","publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.lukaswojcik.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9","name":"luky","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","width":424,"height":636,"caption":"luky"},"logo":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg"},"sameAs":["https:\/\/www.lukaswojcik.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages\/13544","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/comments?post=13544"}],"version-history":[{"count":0,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages\/13544\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages\/38"}],"wp:attachment":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media?parent=13544"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/tags?post=13544"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}