SSL check

Grade A–D, expiry, full certificate chain, negotiated TLS cipher with weak-suite warnings, and a strict CA + hostname trust probe.