{
  "service": "whatcert",
  "provider": {
    "name": "go-crypto-tls",
    "mode": "direct-tls-termination",
    "raw_chain_fidelity": "exact",
    "client_ca_preference": "none",
    "explanation": "The Go process owns the TLS handshake. chain_as_sent preserves r.TLS.PeerCertificates order exactly, and the CertificateRequest advertises no acceptable CA names."
  },
  "tls": {
    "version": "TLS 1.3",
    "cipher": "TLS_AES_128_GCM_SHA256",
    "negotiated_protocol": "h2",
    "server_name": "whatcert.ttl.one",
    "session_resumed": false
  },
  "client_certificate_present": false,
  "certificates_transmitted": 0,
  "chain_as_sent": [],
  "validation": {
    "performed": false,
    "adjacent_signatures_valid": false,
    "complete_self_signed_path": false,
    "cryptographic_chain_valid": false,
    "currently_valid": false,
    "client_auth_eku_valid": false,
    "link_checks": []
  },
  "trust": {
    "store": "container system CA pool",
    "trusted": false,
    "built_path": [],
    "explanation": "This reports trust against the container's system roots, not universal or server-policy-specific mTLS trust."
  },
  "warnings": []
}