SSL Certificate Fetcher

What this does

Opens a TLS connection and reports every certificate the server presents, with validity dates, the names each one covers, and how the chain fares against the system trust store.

Verification is reported rather than enforced, so an expired or self-signed certificate is shown and explained instead of refused — which is usually the reason for looking. Any port works: 993 for IMAP, 465 or 587 for SMTP, 8443 for whatever is on 8443.

Only hosts on the public internet can be reached. Private and reserved addresses are refused, so this cannot be pointed at anything inside the network the site runs on.