TLS Inspection in VitalSite
How VitalSite uses Node’s native TLS module to inspect your certificate, trust chain, and negotiated protocol version.
To check your encryption properly, VitalSite performs a real TLS handshake with your server using Node.js’s built-in tls module — the same low-level layer a browser uses. That lets us inspect the certificate and connection exactly as a real client would, with no third-party dependency.
What it provides
The TLS module gives VitalSite direct access to the details of a live secure connection: the peer certificate (issuer, validity dates, trust chain), whether the chain validates against trusted roots, and the negotiated protocol version (for example TLS 1.2 or TLS 1.3).
Why we use it
Certificate health affects every single visitor at once — an expired or untrusted certificate triggers full-page browser warnings. And weak protocols like TLS 1.0 and 1.1 are deprecated and vulnerable to downgrade attacks. Reading this from a genuine handshake (rather than a third-party summary) means the result reflects what your visitors actually experience.
How VitalSite uses it
The SSL/TLS Certificate check uses the TLS module to:
- Read the expiry date and flag certificates expiring within 30 days (or already expired).
- Verify the trust chain so you catch "not trusted" errors that only show on some devices.
- Record the protocol version and flag deprecated TLS 1.0/1.1 as critical.
Because it’s native to Node, this inspection is fast and runs on every scan. Once your certificate is healthy, the natural follow-ups are HTTPS enforcement and adding HSTS.
Every VitalSite scan draws on this source automatically. Run a free full-domain scan to see your results, or compare plans and pricing.
See if this affects your site
Run a free full-domain scan — this check runs on every page, with an exact fix guide.