The certificate card: for a port that speaks TLS from the first byte, Netfox now reads what the server presents about itself and says what is wrong with it.
Service inspection
- A TLS port's certificate, read on demand. Who it was issued to, who issued it, and when it expires, read from the certificate the server presents when Netfox says hello, on ports that speak TLS from the first byte (443, 8443, 993, 995, 465, 636 and the like). Ports that start in plain text and upgrade later are deliberately left alone: a greeting aimed at them is not a greeting.
- Two verdicts stated outright: expired, and self-signed. An expired certificate is named as such. One signed by itself is called out with the context that matters: normal on a home device that generated its own, worth a second look anywhere else. Self-signed is decided on the names, not on the length of the chain, so a device that also sends a stray intermediate does not get a pass it has not earned.
- Two warnings before they bite. A certificate that runs out within three weeks, and one that is not valid yet, which on a home network almost always means the clock on the device is wrong.
- Behind the same switch as the service lookup, and hidden in Demo Mode. The read happens only when you press the button, under the privacy setting that already governs looking up service info; Netfox never starts a conversation unasked. In Demo Mode the card is not shown at all, since a certificate's name on a home network is very often the device's hostname, which is exactly what that mode exists to keep off a screenshot.
Also
- The What's New panel of this version corrects the 0.18.1 entry, which said nothing in the app had changed. That release also graded the radio's headroom by the same threshold the Wi-Fi tool uses, named the interface the route leaves through, and rewrote two sentences of the link panel. The 0.18.1 release notes were corrected on the day; the panel inside the app could only be corrected here.