HTTPS Reachability Check

Introduction

HTTPS Reachability Check fetches a hostname from DeviceHub’s Cloudflare edge via POST /api/ssl-check and reports status, timing, and selected headers such as HSTS when present. It is not a full SSL certificate-chain auditor.

What this tool does

You enter a bare hostname; the edge function performs an HTTPS fetch or handshake and returns ok, HTTP status when applicable, elapsed time, selected headers, and errors. UI copy repeats that this is reachability, not a cert lab.

When to use it

Use it after DNS cutover, when regions disagree about HTTPS, or when Port Checker shows TCP open but TLS might still fail. Prefer openssl or dedicated CA tools for chain depth, expiry on intermediates, and cipher matrices.

How it works

A Cloudflare Pages Function performs outbound HTTPS from edge POPs. The browser never opens arbitrary host:443 directly. Scope excludes CT logs, OCSP quality, and custom trust stores. Local static preview without Functions shows API unavailable.

Step-by-step instructions

1. Deploy DeviceHub to Cloudflare Pages if local preview reports the ssl-check API unavailable.
2. Open HTTPS Reachability Check and enter a bare hostname without scheme or path.
3. Run the check and wait for POST /api/ssl-check results.
4. Record status, timing, and header hints while noting this is not a full certificate audit.

Common problems

A site that works on your laptop can fail from Cloudflare egress (bot blocks, geo allowlists, split DNS). Self-signed certs fail against the edge trust store. Entering https:// prefixes or paths breaks validation.

Privacy explanation

Your browser sends the hostname you typed to DeviceHub /api/ssl-check. The target sees Cloudflare egress, not your home IP as the TLS client. Permissions stay none.