TLS & Certificates — inspect, decode, and harden transport security

TLS is the one control almost everyone has and almost no one audits past "the padlock is green." The certificate is only the visible leaf; the security actually lives in what can be issued, what gets enforced on the first byte, and what third parties you implicitly trust. This is the working path through all of it.

Beyond the padlock

A valid certificate proves a name, not a posture. Attackers get valid certificates too. The questions that matter are: who is allowed to issue for your domain (CAA), can a downgrade happen before HSTS is known (preload), is the chain complete and using current protocol versions, and what third-party code rides in under your origin. Each has a dedicated step below.

The workflow

1. Ssl Checker — Point it at a live host to read the served chain, expiry, protocol versions and the legitimacy signals — the fastest way to answer "is this endpoint healthy?"
2. Certificate Decoder — When someone hands you a PEM or a chain out of context, decode it locally to see subject, SANs, issuer and validity without trusting a paste site.
3. Caa Hsts Checker — Move from the leaf to the controls: CAA decides which CAs may issue for your domain at all, and HSTS stops the first-request downgrade. Both are cheap and both are usually missing.
4. Csr Tool — Renewal or a new host — build (or sanity-check) a certificate signing request so the subject, SANs and key parameters are right before you send it to a CA.
5. Sri Generator — Any third-party script or stylesheet you load is a supply-chain edge. Generate a Subresource Integrity hash so a tampered CDN asset simply fails to execute.

Where teams get it wrong

• No CAA record. Any public CA can issue for your domain. One CAA line closes that door to everyone except your chosen issuer.
• HSTS without preload. The very first request is still downgradeable until the browser has seen the header once. Preload removes the window.
• Incomplete chains. A server that omits the intermediate "works in my browser" (which caches it) and fails elsewhere. Check the served chain, not your own machine.
• Unpinned third-party scripts. A compromised CDN executes with your origin's trust. SRI turns that from a breach into a failed load.

FAQ

The certificate is valid — isn't that enough?

Validity proves identity, not safety. CAA, HSTS and complete-chain checks are what stop mis-issuance and downgrade; the leaf certificate can be perfect while those are wide open.

Do these tools send my certificate anywhere?

Decoding runs in your browser. The live-endpoint checks run server-side and never forward your IP — see the privacy notice.