🔏 Netfox 0.19.0 — what a certificate says about itself
🔏 Netfox 0.19.0 is out: the certificate card
Every home network has a few TLS services nobody looks at until a browser refuses one: the NAS, the printer, the router's own page. Netfox now reads what they present and says what's wrong with it.
📜 Issued to, issued by, expires — read from the certificate the server presents, on any port that speaks TLS from the first byte.
⛔ Expired: named, with the date.
🪪 Signed by itself: nothing vouches for it. Normal on a home device that made its own, worth a second look anywhere else — and the card says exactly that.
⏳ Two warnings before they bite: runs out within three weeks, or not valid yet (which is usually the device's clock, not the certificate).
🔒 On demand only, behind the same privacy switch as the service lookup. Netfox never starts a conversation unasked, and the card stays hidden in Demo Mode.
The service lookup on an open port; the certificate card sits beside it
👉 See what's new: https://netfox.app
Which service on your network would you check first? 👀
Replies
Can it also show which TLS version and cipher suite the service is using?
Netfox
@oliver_graf1 not yet — the card stops at the certificate: who it's for, who signed it, when it expires, whether it signs for itself. no version, no cipher. you asked for the cipher suite and not just the version, which is the half that actually tells you something, and it's the obvious gap...
good news is it's nearly free. the same handshake that reads the certificate already carries both — I just wired a throwaway client to check rather than guess: TLS 1.3 / TLS_AES_256_GCM_SHA384 against a local server, TLS 1.2 / ECDHE-RSA-AES256-GCM-SHA384 once I pinned that server down a version. so it's two more rows in the card, not a second probe. on the list, no date from me...
one caveat worth stating, tbh, because it's where this kind of feature quietly overpromises: what you'd see is what that server chose while talking to my Mac, not the set it supports. "does it still accept TLS 1.0, does it still do RC4" is a different tool — a handshake per candidate — and port inspection here deliberately sends one hello and hangs up. if that's the question behind yours, say so: I'd rather build the right one than the one that looks similar