Add HTTPS test tools (certificate, HSTS, 302 rewrite)

[vahem2lu]

What type of request is this?

New tool idea

Clear and concise description of the feature you are proposing

Add a tool(s) that is/are capable of doing HTTPS, HSTS and certificate tests.
For example:

• check if certificate is okay (client certificate, indermediate available).
• check if HSTS is working correctly for this domain/subdomain, what is the time
• check if HTTP->HTTPS rewrite is working correctly

Is there example of this tool in the wild?

https://www.ssllabs.com/ for HTTPS certificate
https://domsignal.com/hsts-test for HSTS

Additional context

No response

Validations

• Check the feature is not already implemented in the project.
• Check that there isn't already an issue that request the same feature to avoid creating a duplicate.
• Check that the feature can be implemented in a client side only app (IT-Tools is client side only, no server).
• Everything is written in PLAIN ENGLISH

[sharevb]

Hi @vahem2lu , this is not possible on client side only. This requires a server side part.

[vahem2lu]

HSTS and HTTPS is purely client-side (aka browser or any other client) and there should be typescript HTTP browser also available? And this app+my browser also acts as a client - so we can query it from the same URL as external service (and act as a client).

HTTPS is determined on HTTP response codes and Location header
Example query with curl client:

# curl -I http://domain.tld

Response:

HTTP/1.1 301 Moved Permanently
Date: Mon, 06 Apr 2026 08:13:31 GMT
Server: Apache
Location: https://domain.tld
Content-Type: text/html; charset=iso-8859-1

HSTS is determined on also HTTPS headers, for example

Example query with curl client:

curl -I https://domain.tld

Response:

/---/
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
/---/

Here "preload" means HSTS preload, which is extra to be mentioned, but if domain has HSTS configured, then it's the pre-statement. max-age means TTL for browser (client) to remember preload and includeSubDomains means that all the subdomains should be served over HTTPS only.

[sharevb]

@vahem2lu but there is CORS, so a client side JS cannot access any url if not allowed by server side. So pure client side https tester while have limited use

[sharevb]

But it could be with a server side