What it checks

• Expiry. The days left, a warning inside 30 days, a problem inside 7.
• The chain. Whether the certificates the server sends reach a trusted public root. A missing intermediate is named as that, since it is the most common installation mistake and the one browsers sometimes hide while other clients fail. A certificate from your organisation's own certificate authority is named as that, with the authority's name.
• The name. Whether the certificate covers the name you typed, wildcards included (one label, as browsers match them).
• TLS versions. 1.0 and 1.1 (retired in 2021), 1.2 and 1.3, each tried on its own. A version this checker could not try is said as not tested, never as refused.
• Key and signature. RSA keys under 2048 bits, SHA-1 signatures, and the cipher the server picked.

What it cannot see: the appliance's configuration behind the address, other virtual servers, or anything inside your network. DTR Vantage reads those from the appliance itself.