TLS certificate checker
Resolve a public hostname, connect to the resolved public address with SNI, validate the certificate chain and hostname, then report TLS and HTTPS signals measured from the PublicVPNList server.
How to interpret certificate results
A valid chain and hostname means the presented certificate can be verified for the requested SNI name from this checker. Expiry, SANs, cipher and TLS version still need context. A valid certificate does not prove that a VPN or proxy service is safe.
The checker resolves the hostname once, rejects the entire answer if any address is private, loopback, link-local, reserved or metadata space, and connects to the exact validated address to resist DNS rebinding.
Frequently asked questions
- Does this checker follow redirects?
- No. It reports the first HTTPS status and Location value so the target cannot redirect the backend into another network.
- Can I check an IP address with SNI?
- A certificate normally matches a hostname. Use the hostname when you need meaningful SNI and hostname validation.
- Does a valid certificate mean a VPN is trustworthy?
- No. TLS identity is one transport signal and says nothing about logging, ownership or traffic handling.