Service & Certificate Scan
See what a domain exposes to the internet, and whether every certificate behind it is sound.
30 well-known service ports · TLS and STARTTLS certificates
What this does
Connect, look, disconnect
A TCP handshake and whatever greeting the service volunteers. Nothing is sent that could change state, and no attempt is made to authenticate or enumerate anything.
Every certificate, in full
Issuing authority, subject, alternative names, validity window and days remaining, key type and size, signature algorithm, chain length, and the protocol and cipher actually negotiated.
Including STARTTLS
Mail ports that begin in clear text and upgrade are inspected too. Those certificates are the ones nobody watches, and the ones that quietly expire.
Exposure, not just ports
An open database, remote desktop or cache port is called out as such. Automated scanners find these within hours of them opening.