ipyellow

TLS certificate inspector

Exact-IP connection

Resolve a public endpoint once, connect to that exact address, and inspect certificate validation plus TLS 1.2 and TLS 1.3 negotiation.

All DNS answers must be public. The inspector connects to the validated address with an eight-second overall deadline and caches results for up to 10 minutes.

Enter a public direct-TLS endpointMixed public/private DNS answers, arbitrary ports, redirects, proxies, and STARTTLS services are blocked.

Scope and verification limits

The hostname is used for SNI and certificate-name verification, while the network connection goes to the exact public address validated before the socket opens. This reduces DNS rebinding and server-side request forgery risk.

The tool probes TLS 1.2 and 1.3 only and reports one negotiated cipher for each successful handshake; it is not a full cipher-suite enumerator. Revocation, Certificate Transparency inclusion, OCSP stapling, STARTTLS upgrades, and application-layer behavior are not checked.

Back to tools