Help Centre

Getting Started

Tlsscope is a diagnostic tool that tells you what TLS certificate a server is actually presenting on the wire. It is not a monitoring service, not a scanner, and not a browser extension — it is a focused inspection tool.

How to use it

Go to the App page.
Type a bare hostname (e.g. example.com) — no https:// prefix, no path.
Click Check. Tlsscope opens a TLS connection, reads the full certificate chain, and returns the result within seconds.
Review the report: expiry date, issuer, subject alternative names, chain depth, and a chain-completeness indicator.

That is the entire workflow. No account, no login, no setup. Every check is independent — results are not saved between visits.

One hostname at a time. Tlsscope checks exactly the hostname you enter on port 443 only. It does not scan subdomains, ranges, or alternative ports.

Frequently Asked Questions

1. My site went down — did the certificate expire?

Open Tlsscope, enter your hostname, and check the Expiry date and Days remaining fields. If the certificate has expired, the report will show a red expired badge. If it is still within its validity period, look at the Chain completeness section — a missing intermediate certificate can cause site failures even when the leaf certificate is perfectly valid.

If you see "Could not connect" instead of a certificate report, the server may not be responding on port 443 at all, which points to a different class of problem (DNS, routing, or the TLS listener itself).

2. How do I check when my SSL certificate expires?

Enter your hostname on the App page and click Check. The report shows the exact expiry date and the number of days remaining. This is the actual date the server's certificate advertises — not a cached value from a previous scan.

Tlsscope does not send reminders or alerts. If you need expiry tracking, note the date manually or set a calendar reminder.

3. The certificate looks valid but some users cannot load my site. Why?

This is the exact scenario Tlsscope was built to diagnose. A server can send a valid leaf certificate without the intermediate certificate that chains it to a trusted root. Desktop browsers often cache missing intermediates from previous visits and work anyway. Mobile clients and fresh browser profiles do not — they reject the connection with a trust error.

Check the Chain completeness section in the report. If it says the chain is incomplete, your server needs to be reconfigured to send the missing intermediate certificate(s). Most certificate authorities provide a bundle file for exactly this purpose.

4. Can Tlsscope monitor my certificates and email me before they expire?

No. Tlsscope has no email capability, no scheduled re-checks, and no alerting. It answers when you submit a hostname — that is the only mode of operation. There is no "watchlist," no dashboard, no notification system.

The terms of service explicitly state: "Do not rely on this tool as your sole method of certificate expiration tracking." For automated monitoring you would need a dedicated certificate expiry monitoring service.

5. How do I read the chain report?

The report is organised into three sections:

Leaf certificate (top) — your server's certificate. Shows the subject (your hostname), issuer (the CA that signed it), validity dates, serial number, SHA-1 fingerprint, and all subject alternative names (SANs) it covers.
Intermediates — certificates between the leaf and a root. Each one is listed with its subject, issuer, and validity dates. These are what the server transmitted along with the leaf.
Chain verdict — a summary of whether the chain appears complete. An incomplete chain means at least one intermediate was not sent by the server and must be added to the server configuration.

The SANs list is especially useful: if the hostname you checked is not in the SANs, browsers will show a certificate name mismatch warning regardless of the expiry date.

6. I checked a host behind Cloudflare — is the result correct?

Tlsscope inspects whatever certificate the server presents on the wire. For hosts behind Cloudflare, the server is a Cloudflare edge node, so the certificate you see is Cloudflare's edge certificate — not your origin server's certificate. The inspection itself is accurate (it shows what the edge sent), but it does not tell you about the certificate on your origin server behind Cloudflare.

This is not a bug. It is a fundamental property of how any TLS inspection tool works from outside the network. To inspect the origin certificate, you would need to connect directly to your origin server (e.g. via a VPC or internal network).

Known Limitations

Tlsscope is a young tool. The following limitations are deliberate design choices or honest gaps in functionality that will be addressed as the product develops.

No alerts or email. Tlsscope cannot send notifications of any kind. There is no email sender connected to this fleet. If you need expiry reminders, you must set them yourself.

Port 443 only. Tlsscope checks TLS on the standard HTTPS port. Custom ports (e.g. 8443) are not supported.

One hostname at a time. No subdomain enumeration, no IP range scanning, no bulk lookup. Each request is a single hostname.

No history or persistence. Results disappear when the page is closed. No accounts, no saved searches, no dashboard. Every check starts from scratch.

Pro features are not yet built. JSON export, API access, priority queue, and extended audit details are under development. The Pro subscription on the pricing page is a placeholder — no payment processor is connected and no purchases can be made.

No legal entity registered. The service is operated on a best-effort basis. There is no registered company, jurisdiction, or official business address. The privacy policy and terms of service reflect intended data practices but are not yet backed by a legal entity.

Cloudflare edge certificates. Hosts behind Cloudflare will show Cloudflare's edge certificate rather than the origin server's certificate. This is an inherent external limitation, not a tool defect.

Contact Us

Email support is not yet available. There is no support mailbox configured for this service and no customer support team in place.

If you encounter a technical issue with the tool itself (a hostname you believe is valid returns an error, the page does not load, or the report appears incorrect), please record the details and check back for updates. A contact channel will be established once the service matures.

For business or partnership inquiries, the same limitation applies — there is no inquiry address or legal entity to receive correspondence at this time.

Before contacting us: check the FAQ above for common questions. If you are troubleshooting a certificate problem on your own server, Tlsscope is a diagnostic aid — it reports what the server sends. It cannot fix misconfigured servers, renew certificates, or advise on certificate authority choices.

Tlsscope is an open diagnostic tool. No support inbox exists yet. When one is established, this page will be updated with contact details.