This guide explains how to inspect the certificate and handshake layer of a public NMDCS or ADCS endpoint.
Usage
- Open TLS Certificate, enter the public hostname or secure hub URL in Host Or Address, and enter its TCP Port.
- Use the same hostname that DC++ clients use, because certificate name matching depends on it.
- Select Inspect TLS and review identity, issuer, validity, alternative names, and negotiated details.
Concrete Example
Before publishing nmdcs://secure.example.net:1411, inspect secure.example.net on port 1411. The certificate should be within its validity window and include that hostname in its subject alternative names. A certificate for another host can trigger client warnings.
Interpretation
The certificate name and alternative names identify covered hosts. Issuer and the certificate chain show whether clients can build trust to a public CA or a self-signed authority. Valid-from, valid-until, and days remaining expose expiry risk. Negotiated protocol and cipher show that a TLS handshake completed, not that the hub login completed.
Troubleshooting
- Expired: Renew and install the new certificate, then restart or reload the listener.
- Name Mismatch: Issue a certificate containing the public hub hostname.
- Missing Chain: Configure the full certificate chain expected by clients.
- Handshake Failure: Confirm that the port is TLS-enabled; a plaintext listener cannot complete TLS. Compare TCP Connect with Protocol Test.
Icon Reference
| Icon | Label | What It Does |
|---|---|---|
| Inspect TLS | Inspect TLS starts the bounded handshake and certificate inspection. | |
| Complete | Complete marks a finished TLS inspection. | |
| Review Output | Review Output marks a certificate or handshake detail that needs attention. | |
| Open Help | Open Help opens this guide from the TLS panel. |