The TLS certificate tool reads names, issuer, validity and key of a server certificate. The HTTP check follows redirects and checks HTTPS and security headers.

Two tools in the Netzwerk (network) category check web servers and other TLS services: TLS-Zertifikat looks at the certificate, the HTTP-Check at a website’s redirects and headers. Both require a license.

TLS certificate

In the Host[:Port] field, enter a hostname, for example inwendo.de. Without a port, the app connects to 443. Check other TLS services with a port, for example mail.example.com:993 for IMAPS. For mail servers with STARTTLS on port 25 or 587, use the SMTP test, which shows the same certificate.

The app opens a TLS connection (10-second timeout) and reads the server’s certificate. The Zertifikat table shows:

Field	Content
Inhaber, Aussteller	subject and issuer
Gültig ab, Gültig bis	validity period
Namen (SAN)	all hostnames the certificate is valid for
Schlüssel	key type and length, for example RSA 2048 bits or ECDSA P-256
Signatur	signature algorithm
Seriennummer, SHA-256, SHA-1	serial number and fingerprints for unique identification

Findings

Finding (as shown in the app)	Meaning and what to do
Zertifikat ist vertrauenswürdig	The operating system trusts the certificate and its chain.
Zertifikat wird vom System nicht als vertrauenswürdig eingestuft	Not trusted: self-signed, unknown CA, missing intermediate certificate, expired or wrong name. Installing the full chain on the server usually helps.
Selbst signiertes Zertifikat	Self-signed: browsers and mail servers don’t trust it. Use a certificate from a CA, for example Let’s Encrypt.
Name … passt zum Zertifikat	Name matches: OK. Wildcards like `*.example.com` only cover the leftmost label.
Name … steht nicht im Zertifikat	The certificate is for other names. The finding lists which ones it contains.
Keine Subject Alternative Names	Browsers require SAN.
Gültig bis … (… Tage)	Valid until …: OK.
Zertifikat läuft in … Tagen ab	Expires soon: under 30 days a warning, under 14 days an error. Find out why automatic renewal isn’t working.
Zertifikat abgelaufen am …	Expired. Renew immediately.
Veraltete Signatur	Outdated signature: SHA-1 or MD5. Have a new certificate issued.
RSA-Schlüssel zu kurz	RSA key under 2048 bits.
HTTP/2 per ALPN ausgehandelt	On port 443: the server speaks HTTP/2. Otherwise you get the note „Kein HTTP/2“.

The app doesn’t show intermediate certificates or the TLS version, because the system’s TLS library only hands out the server certificate. The trust check does include the chain, though: if an intermediate is missing, the certificate isn’t trusted.

The TLS certificate tool runs on macOS, Windows, Linux, iOS and Android. It is hidden in the web version.

HTTP check

In the URL oder Domain field, enter a domain such as inwendo.de or a full URL. Without https://, the app starts at http:// so it checks the redirect to HTTPS as well.

The app requests the address and follows each redirect individually, up to ten steps, with a 15-second timeout per request. The Weiterleitungen (redirects) table shows each step with URL, status, target and duration; the Antwort-Header (response headers) table shows all headers of the final response.

Redirects and reachability

Finding	Meaning
HTTP 200 nach … Weiterleitung(en)	OK.
HTTP leitet dauerhaft auf HTTPS um	OK: direct redirect with 301 or 308.
HTTP leitet auf HTTPS um (Status …)	Note: a permanent redirect (301/308) straight to the HTTPS address is better.
Keine Umleitung auf HTTPS	No redirect to HTTPS; visitors stay on unencrypted HTTP. Set up a 301 redirect.
… Weiterleitungen	Note with more than two steps: each one costs a round trip, point directly to the target.
Zu viele Weiterleitungen	Too many redirects, probably a loop.
HTTP 4xx or 5xx	The page returns an error.

Security headers

If the chain ends on HTTPS, the app checks the most important security headers:

Header	If missing	Recommendation
`Strict-Transport-Security` (HSTS)	warning	`max-age=31536000; includeSubDomains`. Under half a year you get a note.
`Content-Security-Policy`	warning	limits where scripts may load from and mitigates XSS
`X-Content-Type-Options`	warning	`nosniff`
`X-Frame-Options` or CSP `frame-ancestors`	warning	protection against framing (clickjacking)
`Referrer-Policy`	note	`strict-origin-when-cross-origin`
`Permissions-Policy`	note	locks camera, microphone, location and the like

If the Server header reveals a version number, you also get a note, since version details make targeted attacks easier.

In the browser

In the web version, CORS blocks many requests. If the HTTP check fails there, use the desktop app.

TLS Certificate and HTTP Check