Inspecting only the connection to this site
The browser SSL/TLS connection information display tool provided on this page is a single-function UI component that visualizes the negotiated connection parameters between the browser you are currently using and the server delivering this site (ZeroTools).
The security protocol version (such as TLS 1.3) and connection protocol displayed on the screen strictly indicate the communication status during the "connection diagnostic request to this site." Features such as entering an arbitrary website domain or URL into a text box to retrieve the SSL/TLS certificate used by an external site, or checking the remaining days until the certificate expires, are not implemented.
Additionally, there is no function to audit the vulnerability of the target server or to visualize the certificate chain hierarchy.
This tool is designed simply to automatically start a connection diagnosis exactly once immediately after the page is mounted, using a React useEffect hook.
Unimplemented processes, such as executing queries against external databases, deducing connection states using AI, or detecting fraudulently issued certificates, are not performed.
Considering that it only targets communication with this site's delivery infrastructure, please use it for fact-checking purposes to see what kind of negotiation your local browser has performed.
Acquisition route and communication
The various connection parameters displayed on the screen by this tool are obtained by making an asynchronous HTTP request (fetch API) to the connection diagnostic endpoint (/cdn-cgi/trace) of the Cloudflare environment used by this site.
This tool accesses the same-site endpoint and returns the communication properties negotiated between the client that sent the request and the server as newline-separated plain text (in the format ip=..., loc=...).
The tool splits this text data by newlines and equals signs (=), parses it into internal JavaScript objects, and binds it to the screen.
Due to this mechanism, accessing via a public environment routed through Cloudflare's edge network is a mandatory condition for running the diagnosis.
If accessed from an environment where the specified trace path does not exist, such as when running a test in a local development environment, the HTTP status will become an error and an error message stating "Failed to obtain Cloudflare connection diagnostic endpoint." is drawn on the UI.
Note that in this English implementation, missing ip or http keys in the parsed text data do not trigger an error, meaning strict validation for these essential keys is not implemented.
Reading TLS and HTTP
Among the connection information acquired from the endpoint, the TLS version and HTTP protocol values form the foundation of encrypted communication.
The "Security Protocol" on the tool displays the encryption connection version string negotiated on the server side, such as TLS 1.3 or TLS 1.2.
If the target item (tls) is missing from the HTTP response text, it simply displays "No TLS connection" rather than enforcing strict validation; this fallback label is NOT evidence that the connection is unencrypted.
The "Connection Protocol" item displays the HTTP version, such as http/2 or http/3. In this English implementation, the parsed http value is preferred; only when missing does it fall back to the protocol information acquired from the Performance API (PerformanceNavigationTiming.nextHopProtocol) during page load.
If a navigation entry exists but nextHopProtocol is empty, the code uses "HTTP/1.1". With no navigation entry, localProtocol remains unknown.
These fallbacks are not a measured diagnostic HTTP version.
IP, Country Code, and colo
As client environment information, the connection source global IP address (ip), connection country code (loc), and the string data of the responding edge server (colo) are displayed.
The global IP address is the client's source IP address as seen from the server side that received the connection diagnostic request, and if you are accessing via a proxy server or VPN, the final relay point's IP address will be displayed.
The format of the displayed value is the string representation of IPv4 or IPv6.
The connection country code is a 2-letter alphabet string (equivalent to ISO 3166-1 alpha-2) indicating geographical allocation information based on the IP address.
This country code indicates rough allocation based on an IP address database and is not information that guarantees the user's precise physical location like GPS coordinates.
Also, the "Responding Edge Server (Colo)" displays a 3-letter code (NRT, KIX, etc.) indicating the Cloudflare data center that actually processed the request.
This reflects network routing results such as BGP anycast, and there is no guarantee that the user's geographically nearest server will respond.
Missing KEX, RTT, and WARP
As detailed parameters of the encrypted connection, the key exchange algorithm (kex), connection delay (rtt), scheme (visit_scheme), and Cloudflare WARP connection state (warp) are parsed and deployed in the UI grid area.
The key exchange algorithm (kex) is a string indicating the method (such as X25519) used to securely share the common key at the start of communication.
The scheme (visit_scheme) contains values like https, and the value obtained by removing the colon from the browser's window.location.protocol is set as a fallback.
RTT (Round Trip Time) represents the round-trip delay. The tool itself has no processing to measure the required time, and only displays the value if the endpoint returns rtt.
If this value is not included in the response from the endpoint or is in an unmeasurable state, the string "Unmeasurable" is displayed as is.
Additionally, the WARP connection state is an indicator to determine whether the user is accessing using the Cloudflare WARP client, but if the warp item itself is missing from the response, the English version simply displays "off", which does not serve as measurement proof.
Even when parts of the data are missing, the tool displays other successfully parsed information but does not unilaterally generate unentered actual measurement values.
Reloading and hiding upon sharing
By clicking the "Reload" button placed in the card header on the screen, you can re-execute the asynchronous request to the connection diagnostic endpoint without reloading the entire page in the browser.
During the request, a loading spinner icon is displayed, and the button temporarily becomes disabled. This can be used as an operation to check fluctuations in communication properties right after switching networks or changing VPN connection states.
If acquisition fails due to response anomalies from the endpoint, you can call the same re-acquisition process from the "Attempting to reconnect" button in the error panel.
The information displayed on this tool's screen includes unique parameters capable of identifying the user's network environment and device, such as the global IP address and the detailed User-Agent string obtained from navigator.userAgent, as plain text.
When taking a screenshot of the screen to share on SNS, etc., please take measures to conceal items like the IP address and User-Agent via image editing as necessary so that your network information is not unintentionally published.
While information conversion is performed within the browser, be aware of the fact that Cookies may be sent in subsequent HTTP requests during the diagnostic request or overall site communication.