What does the SSL checker look at?
A browser on HTTPS (or any TLS service) checks the X.509 certificate, SAN list, chain and protocol. This tool handshakes from this Linux host to the host:port you give and sends the hostname as SNI. You get the issuing company (Let’s Encrypt, DigiCert, Cloudflare, Google Trust Services…), days left, protocol, cipher, CN, expiry, SAN, SHA-256 fingerprint and which of TLS 1.3/1.2/1.1/1.0 the server accepts.
authorized false is what a browser would warn on: missing intermediate (no fullchain), name mismatch or an expired cert. This is not a pentest or an SSL Labs grade; one hop, one IP.
Custom ports and SNI
Default is 443. Pick 8443, 2083, 993, 465 or type 1–65535. Paste https://example.com:8443 to fill the port. IPv6: [2001:db8::1]:443.
SNI lets a virtual host pick the right certificate. An IP may return the default (first) cert; use the name. 587/143 are STARTTLS; this tool speaks TLS immediately and usually fails — use 465 and 993.
SAN, wildcards and the chain
SAN is the names the browser compares. CN alone is not enough. *.example.com does not cover the apex example.com; it does cover www.example.com. Put both on the cert or redirect one to the other.
Let’s Encrypt lasts ~90 days; if fewer than 30 remain, check certbot/acme. The chain must be leaf + intermediate (fullchain); leaf-only fails on mobile. OCSP stapling is not always in this summary.
TLS 1.0–1.3
TLS 1.3 is preferred, 1.2 is still common. 1.0 and 1.1 are rejected by PCI and modern browsers; turn them off. The tool probes each version; “supported TLS” is what the server accepts, not your browser’s preference order.
RFC 1918 and loopback are refused. The probe leaves this host, not your PC; CDN/anycast may show a different PoP certificate.