Getting started
Leafscope answers one question: when does this certificate expire, and what breaks when it does? You paste a hostname, and it opens a real TLS connection to that server on port 443, reads the certificate chain the server actually sends, and reports the details.
Go to the Check page
Navigate to leafscope.agen2ic.ai/app. No account or sign-up is needed — the page loads and you are ready to go.
Enter a hostname
Type the hostname (e.g. example.com) and click Check. The hostname is all you need — no port specification, no protocol prefix. The tool connects on port 443.
Read the report
Leafscope displays a status banner (Valid / Expiring soon / Expired / Chain incomplete) and detailed rows showing the not-before and not-after dates, days remaining, issuer, subject, every subject alternative name (SAN) the certificate covers, and whether the server sent its full chain on the wire.
You can also try the example links on the Check page to see how different certificates look: github.com, wikipedia.org, expired.badssl.com.
Frequently asked questions
When a browser connects to your server, the server should send the full certificate chain — the leaf certificate plus the intermediate certificates — so the browser can validate the chain of trust. Many servers send only the leaf and expect the browser to fetch the intermediate from a well-known location.
Desktop browsers often succeed anyway because they cache intermediates from previous visits to other sites that used the same CA. Mobile browsers and first-time visitors do not have that cached data. The connection fails, and the user sees a certificate warning or "your connection is not private" — even though the certificate itself is still within its validity period.
Leafscope detects this by reading exactly what the server sends on the wire. If the server omitted an intermediate, the report says the chain is incomplete. Fixing it usually means installing the intermediate certificate(s) on your server alongside the leaf.
No. Leafscope is a check on demand tool — you ask it a question, it answers right then. It does not monitor certificates, does not send email reminders, does not run scheduled checks, and does not maintain an account for you. If you need proactive monitoring, we recommend setting up a cron job that calls a tool like openssl s_client or using a dedicated certificate monitoring service.
The Pro plan (currently under development) may include batch inspection and report export, but it will not include email alerts — there is no email sender in this fleet.
This is the most common scenario the chain-completeness check catches. Read the answer about chain incompleteness above. If Leafscope reports the chain as complete, the issue may be on the visitor's side (outdated trust store) or the certificate may not cover the hostname they typed (check the SANs list in the report).
If the report shows no issues (valid, chain complete, and hostname matches a SAN), the problem is likely not a TLS issue — it could be a browser cache, a proxy inspection certificate, or something else in the network path. Leafscope reports what the server presented at the time of the check; intermittent problems may require multiple checks from different locations.
An error or timeout means Leafscope could not complete a TLS handshake with the host you specified. Possible causes:
- The hostname does not exist or the DNS record could not be resolved.
- The server is not listening on port 443.
- The server refused the TLS connection (e.g., port blocked by a firewall, or the server does not accept connections from this network).
- The hostname is a subdomain that has no A or AAAA record.
Leafscope does not infer anything beyond what it observed on the wire. If the connection failed, the report shows the error message returned by the system — no guesses about the server's configuration.
No. Leafscope checks exactly the hostname you typed — no range scanning, no subdomain enumeration, no CIDR sweeps. If you want to check www.example.com, api.example.com, and mail.example.com, you run three separate checks.
Batch inspection across multiple hostnames is listed as a planned feature for the Pro plan. Today, each check is one hostname per request.
No. The hostname you type is used only for that single inspection. The certificate retrieved from the server is displayed to you in your browser and is not stored on any server. Leafscope does not log hostnames, does not create accounts, and does not use cookies or tracking scripts. See the Privacy Policy for full details.
openssl s_client?They read the same data — what the server actually sends on the wire. Leafscope presents it in a structured, readable format without requiring a terminal, and it explicitly calls attention to the chain completeness and the SAN list, which are easy to overlook in a raw openssl dump.
If you are comfortable on the command line, openssl s_client -showcerts -connect example.com:443 gives you the raw chain. Leafscope is the same source, presented for people who want the answer without parsing PEM blocks.
Known limitations
Leafscope is a focused tool with honest boundaries. Here is what it does not do, and what is still under development:
- No alerts, email reminders, or scheduled re-checks. This tool answers when you ask it, and that is the only mode it supports.
- No accounts, no persistent data, no inspection history. Every check is ephemeral — once you close the page or navigate away, the result is gone.
- No batch or bulk inspection. Each check inspects one hostname. Batch inspection is planned for the Pro plan.
- No report export (CSV, JSON, PDF). Export is planned for the Pro plan but is not yet implemented.
- No subdomain enumeration, no CIDR range scan, no network discovery. Leafscope inspects exactly the hostname you provide.
- The Pro plan and its checkout form are a demonstration only. No payment processor is connected. No real payments are taken, processed, or stored.
- No legal entity has been registered for this service. Until the operator registers one, no binding terms of service or privacy policy are in effect.
- No contact email is available on this domain. See the "Contact" section below.
How to reach us
Support is not yet reachable by email or live chat. The operator has not set up a contact mailbox or support system on this domain. Posting an email address that cannot receive mail would be worse than stating the honest situation.
For now, the best way to report issues or request features is undocumented — the operator must first provision a contact channel. This requirement has been recorded as an owner action item.
When a contact method is available, it will be published here and in the site footer. If you are the operator, see needs.md in the project root for the setup steps.