Inspect the certificate an origin actually presents — connecting to a host/IP while sending any SNI you choose. Mirrors how Cloudflare pulls from your origin. No install required.
openssl s_client -connect <host>:<port> -servername <sni>. The connect target and the SNI are independent — that's the point. Cannot reach Cloudflare IP ranges (Workers restriction).