Submission declined on 11 June 2026 by Bonadea (talk). This draft's references do not show that the subject meets Wikipedia's criteria for inclusion. The draft requires multiple published secondary sources that: provide significant coverage: discuss the subject in detail, not just brief mentions or routine announcements; are reliable: from reputable outlets with editorial oversight; are independent: not connected to the subject, such as interviews, press releases, the subject's own website, or sponsored content. Please add references that meet all three of these criteria. If none exist, the subject is not yet suitable for Wikipedia. If you would like to continue working on the submission, click on the "Edit" tab at the top of the window. If you have not resolved the issues listed above, your draft will be declined again and potentially deleted. If you need extra help, please ask us a question at the AfC Help Desk or get live help from experienced editors. Please do not remove reviewer comments or this notice until the submission is accepted. Where to get help If you need help editing or submitting your draft, please ask us a question at the AfC Help Desk or get live help from experienced editors. These venues are only for help with editing and the submission process, not to get reviews. If you need feedback on your draft, or if the review is taking a lot of time, you can try asking for help on the talk page of a relevant WikiProject. Some WikiProjects are more active than others so a speedy reply is not guaranteed. How to improve a draft Wikipedia:Contributing to Wikipedia – a basic overview on how to edit Wikipedia. Help:Wikitext – how to use the markup Help:Referencing for beginners – how to include references Wikipedia:Article development – how to develop your article Wikipedia:Writing better articles – how to improve your article Wikipedia:Verifiability – make sure your article includes reliable third-party sources You can also browse Wikipedia:Featured articles and Wikipedia:Good articles to find examples of Wikipedia's best writing on topics similar to your proposed article. Improving your odds of a speedy review To improve your odds of a faster review, tag your draft with relevant WikiProject tags using the button below. This will let reviewers know a new draft has been submitted in their area of interest. For instance, if you wrote about a female astronomer, you would want to add the Biography, Astronomy, and Women scientists tags. Add tags to your draft Editor resources Easy tools: Citation bot (help) | Advanced: Fix bare URLs Declined by Bonadea 2 months ago. Last edited by Bonadea 2 months ago. Reviewer: Inform author. Resubmit Please note that if the issues are not fixed, the draft will be declined again.

CheckMyHTTPS is an open-source cybersecurity project designed to verify whether secure web connections using the HTTPS protocol are being intercepted, decrypted, or tampered with by a third party. The project provides several tools, including browser extensions and mobile apps, designed to detect Man-in-the-Middle (MITM) attacks or SSL/TLS inspection mechanisms deployed by certain security devices.

CheckMyHTTPS compares the TLS certificate received locally by the user with the one observed simultaneously by an external verification server. If the two certificates differ, this may indicate that a man-in-the-middle is intercepting the HTTPS traffic.

The project’s tools use a system of icons to indicate the connection status:

• Green: connection not intercepted;
• Red: interception detected;
• Gray: verification impossible;
• Black: verification in progress.

The default verification server is checkmyhttps.net, but users can host their own verification server.

CheckMyHTTPS was designed to highlight situations in which an HTTPS connection can be intercepted or inspected without the user’s knowledge. The project is based on the idea that the presence of the HTTPS padlock in the browser does not always guarantee that there is no intermediary between the user and the website being visited.

In certain environments, particularly on public Wi-Fi networks, an attacker can set up a fake access point with a name similar to that of a legitimate network. Devices may then connect to it automatically, especially when the signal from the fake network is stronger or closer.

Once connected to this fraudulent access point, all internet traffic passes through the attacker, who acts as an intermediary between the user and the services being accessed. Even though HTTPS normally encrypts communications, some attacks seek to bypass this protection by presenting fake digital certificates to impersonate the visited sites.

In this context, CheckMyHTTPS allows you to verify whether the certificate received by the browser actually matches the expected one or if it was replaced during the connection process. ^[1]

Some cybersecurity solutions, including antivirus and network monitoring software, inspect the content of HTTPS connections to detect malware, dangerous downloads, or suspicious behavior.

To perform this inspection, these programs temporarily decrypt HTTPS traffic on the user’s machine before re-encrypting it for the browser. To ensure this operation is accepted without triggering an alert, they typically install their own certificate authority on the operating system. The browser then considers the locally generated certificates to be trustworthy.

In this type of configuration, the HTTPS padlock remains displayed even though the connection is technically intercepted by a local intermediary. CheckMyHTTPS detects this modification by comparing the certificate seen by the user with the one observed from an external server. ^[2]

Many companies deploy security devices capable of analyzing employees' HTTPS traffic. These devices are used to block malicious websites, prevent data leaks, or enforce internal security policies.

The process works similarly to antivirus software: the security device intercepts the HTTPS connection, decrypts the traffic, analyzes it, and then establishes a new encrypted connection to the final site. To avoid security warnings in browsers, the company typically installs an internal certificate authority on workstations.

The user thus continues to see an HTTPS connection that is considered valid by their browser, even though the traffic is being inspected by the organization’s network infrastructure. CheckMyHTTPS identifies this type of interception by detecting differences between TLS certificates received locally and those observed remotely. ^[3]

The project offers several implementations:

• extension for Mozilla Firefox;
• extension for Google Chrome;
• extension for Microsoft Edge;
• extension for Opera;
• Android app;
• page for manually verifying HTTPS certificates.

In this type of verification tool, part of the process relies on the exchange of minimal technical information necessary for analyzing HTTPS certificates. Specifically, this mainly involves the domain name being accessed and the IP address of the server being contacted, in order to compare the different aspects of the connection.

However, the project’s objective is not to analyze the content of the user’s communications or to track their online activity. The data used is strictly limited to the TLS certificate verification process.

The project also adopts a transparency-oriented approach by publishing the source code under the free GNU GPL v3 license. This allows anyone interested to examine the tool’s internal workings, understand how HTTPS interception detection is performed, and, if necessary, verify for themselves the absence of hidden mechanisms.

Finally, this openness also allows for a certain degree of flexibility in use: it is possible to deploy your own independent verification server. This option may be relevant in environments where you wish to maintain full control over the infrastructure used for certificate checks. ^[4]