Network diagnostics

HTTPS & Reverse Proxy Checker

Enter your hostname to check from the internet whether HTTPS works, whether the TLS certificate is valid, what HTTP returns, and whether your reverse proxy is healthy.

The check reads the TLS handshake and response headers only. It never downloads page content and never scans ports.

HTTPS & Reverse Proxy Checker

For example: nas.example.com. Standard ports 80 / 443 only — URLs, ports, and IP addresses are not accepted.

Enter a hostname to start

Next steps

Continue troubleshooting with these tools depending on the result.

How the HTTPS check works

The check runs from the 17NAS server along this path: DNS resolution → TCP connection on port 443 → TLS handshake → certificate chain and hostname verification → HTTP request reading the status code. Certificate verification uses the system trust store, and problems such as expiry, hostname mismatch, and self-signing are reported distinctly. Only status codes and response headers are read — page content is never downloaded.

Common HTTPS problems

  • Expired certificate: Let's Encrypt certificates last 90 days, and browsers refuse the connection once automatic renewal fails.
  • Hostname mismatch: the certificate does not cover the subdomain you visit (for example, a certificate for example.com does not cover nas.example.com).
  • Connection refused or timeout: port 443 is not forwarded, the reverse proxy is not listening, or a firewall blocks inbound traffic.
  • 502 / 504: the entry point works but the backend is failing — common right after setting up a reverse proxy while the application container is not running.

Why reverse proxies return 502 or 504

A reverse proxy forwards requests to a backend application. A 502 means the proxy reached the backend address but the connection failed or the response was invalid — typically the app is not running, the upstream host or port is wrong, or the container network is broken. A 504 means the proxy connected but timed out waiting — typically a hung or overloaded app, or a backend firewall dropping the connection. Both indicate the proxy layer works and the problem sits between the proxy and the backend.

What to check next

Use the DNS / DDNS Checker when the hostname may point to the wrong IP, the Open Port Checker to confirm 443 is reachable, the CGNAT Checker when you may be behind carrier-grade NAT, the Port Forwarding Helper to review forwarding rules, and the IPv6 Test for dual-stack status on IPv6-only setups.