TLS Handshake Inspector — Watch the Negotiation Directly
This opens a TLS connection and shows you the handshake itself: every certificate the server presented in the order it presented them, the protocol version and cipher agreed, the verification result, and any error encountered building a path to a trusted root. It is the lowest level view available short of a packet capture, and it is where you go when higher-level tools disagree.
Why run it
For the class of problem where the certificate is valid and the connection still fails. The commonest is a missing intermediate: your browser succeeds because it already holds that intermediate from elsewhere, while a server-to-server client with an empty cache fails outright — so the site works and an integration does not. Seeing the chain exactly as sent, rather than as your client reconstructed it, is the only way to distinguish those. It is also the tool for testing SNI behaviour, where a host serves different certificates depending on the name requested.
Why automate it
Chain composition is not stable. Certificate authorities reissue intermediates and change their hierarchies, renewal can quietly change which chain is served, and a load balancer reconfiguration can drop an intermediate that was previously included. None of that produces an error on your side and none of it is visible from a browser. Capturing the presented chain on a schedule and comparing it turns an invisible change into a detectable one — usually days before the integration that depends on it fails.
What it gives you
Ground truth about a TLS connection when everything else is ambiguous. It is the tool that explains why one client succeeds and another fails against the same endpoint, which is otherwise one of the more frustrating problems to chase.