checkfleet

TLS handshakes check

tls — TLS handshakes

Deep TLS inspection — chain validity, leaf expiry, hostname mismatch, weak negotiated protocol version.

checkfleet check tls --config checkfleet.yml

Deep TLS check — complements certs (which only reads leaf expiry).

  • Chain: verifies the presented chain against the trust store (with the hostname); invalid (untrusted, hostname mismatch) → BAD.
  • Expiry: leaf days-to-expiry → OK/WARN/BAD (warn_days/crit_days).
  • Protocol: the negotiated version; below TLS 1.2 → WARN (connects permissively down to TLS 1.0 just to observe and flag it).
  • Unreachable / handshake failure → ERROR.

Findings are labelled target [chain], target [expiry], target [protocol].

See Configuration → checks.tls.

See the full module reference for every check, or configuration for the config keys.