// TOOLS

Security Tools

🔒 TLS/SSL Analyzer

Enter a host and inspect its certificate and TLS: expiry, trust chain, name match, negotiated protocol and cipher, key size and type, and an A–F grade. The probe runs on the server and only connects to public IPs. Need to configure it? Use the TLS config generator.

Try:
🔒 The certificate is read by establishing a TLS connection from the server. No traffic is sent to the analysed site beyond the TLS handshake, and private or internal addresses are never contacted.

Frequently asked questions

How does it read the certificate without installing anything?
The CyberEscudo server opens a TLS connection to the host and captures the certificate it presents; you just see the report. Nothing is installed or run on your machine.
Can I analyze localhost or an internal host?
No. For security (anti-SSRF protection) it only connects to public IPs and rejects private, loopback, link-local and metadata addresses such as 169.254.169.254.
What does the A–F grade mean?
It summarizes the state at a glance: A is fine (TLS 1.2/1.3 and a valid, trusted certificate); it drops to C for a weak signature (SHA-1), an RSA key below 2048 bits or an old protocol; and F if the certificate is expired, mismatched or self-signed.
Can I use a port other than 443?
Yes. Type host:port (for example mail.example.com:993) and it will probe that port instead of 443.