d4 · tools · tls
Point it at any public host and see what its certificate really says: expiry countdown, the names it covers, the issuer chain, key strength, the negotiated protocol and cipher, and whether the chain verifies against the system trust store.
The inspector makes at most two TLS connections per lookup (one to capture the chain, one to verify trust against this server's CA store), only ever to publicly routable addresses on the ports listed, and is rate limited. STARTTLS services (SMTP on 25/587) are not supported: they need a protocol conversation before TLS begins. Lookups are not logged.