SSL/TLS Certificate Validation Tool for Pre-Authentication Captive Portals

Public network captive portal often disrupts the handshake in the SSL/TLS protocol and displays browser warnings that are sometimes ambiguous and sometimes excessive. These warnings can be misleading for users even for those with technical expertise. Notwithstanding the associated risks, there are limited tools that can be used to validate the trust of the SSL/TLS certificates in pre-authentication environments. This paper presents a lightweight and automated tool that is designed to validate the contents of an extracted certificate chain of SSL/TLS from live or stored handshake traffic at captive portals. The tool uses the trust evaluation engine of OpenSSL, supplemented with a Mozilla-compatible CA bundle to determine the validity of certificates and enables automatic retrieval of the missing intermediate certificates through AIA URLs to improve the accuracy of validation. The tool was evaluated using TLS handshakes captured from the IIUM Wi-Fi captive portal and samples from the ISCXVPN2016 dataset. After intermediate correction, the tool achieved 100% detection accuracy with no false positives and false negatives. It was able to detect misconfigured, expired or incomplete chains and validate known secure sessions. The proposed solution had more accurate and actionable diagnostics compared to browser-based indicators and tools like SSL Labs in pre-login situations, where existing methods often fall short. This tool fills an important gap in network security for users, by enhancing transparency and trust in certificate assessment. Its automation and diagnostic clarity make it an effective tool for both researchers and general users and provide reliable SSL/TLS validation in environments where conventional trust signals are unavailable or misleading.