How to Audit the TLS Handshake in Production
The certificate in your inventory is not always the certificate your endpoint serves.
Load balancers cache. Services miss reloads. Intermediate chains get bundled wrong. SNI routes point to the wrong default. A renewal can succeed and production can still be wrong.
Endpoint verification path
What endpoint checks catch
The obvious failure.
Common with default vhosts and SNI.
Clients fail even when leaf is valid.
Renewed in storage, old on wire.
Command-line checks are useful
OpenSSL, curl, and browser dev tools can all tell you what an endpoint is serving. For one endpoint, that is enough.
For a fleet, manual commands become another spreadsheet. The important part is storing the result and linking it to the certificate and owner.
Check the route clients use
Probe the public hostname, internal hostname, port, and SNI value that clients actually hit. Checking the wrong interface can hide the real problem.
For HAProxy, Nginx, IIS, and Java services, confirm the served chain after reload, not before.
Use probes as part of renewal
A probe should run after renewal and delivery. If it fails, alert the owning group with the mismatch: expected fingerprint, served fingerprint, hostname, issuer, chain, and expiry.
That is much more useful than a generic "SSL problem" alert.
Endpoint verification checklist
- ✓ Use the real hostname and SNI value.
- ✓ Check leaf certificate, chain, issuer, SANs, and expiry.
- ✓ Compare served fingerprint with inventory.
- ✓ Run after service reload, not just after issuance.
- ✓ Keep the result as audit evidence.
Related reading and workflows
Certificate lifecycle management
Inventory, renewal, delivery, ownership, and audit for TLS certificates.
Certificate delivery tokens
Scoped certificate access for HAProxy, IIS, Nginx, scripts, and automation.
Endpoint probes
Check what production endpoints actually serve after renewal.
TLS expiry monitoring on bare metal
How to monitor endpoints outside managed cloud certificate services.
Try the workflow against real infrastructure
Use the hosted evaluation at trust.certlocker.io for a walkthrough, or run a one-month onsite evaluation against your own certificates, hosts, secrets, and access paths.