SSL Certificate Checker
Connects to a host, shows the served chain, expiry, protocol and cipher support, and flags chain gaps.
Connects to a host over TLS and reports what it was actually served: the certificate chain leaf to root, the days left on each, the protocol versions the server will and will not accept, and the cipher it negotiated. Every finding is from a live handshake rather than a database.
Our server makes this request for you. Only the hostname is sent to it — none of your cookies or login state goes along. The server will only connect to public addresses and refuses private and internal ones.
How to use it
Enter the host, with a port if it is not 443
example.com, or example.com:8443. Ports that start in TLS immediately — 8443, 465, 993, 995, 636, 853 — all work; STARTTLS ports such as 587 do not.
Read the verdict, then the findings
The verdict is a summary of the findings below it, each tagged good, note, caution or problem. Expiry inside thirty days and an incomplete chain are the two that most often matter.
Check the chain order, not just the leaf
The chain is shown in the order the server sent it. A server that omits its intermediate works in Chrome, which fetches the missing one, and fails in curl and on older Android — a class of bug that looks like "it works on my machine" for weeks.
Look at which protocol versions are accepted
Each version is tried in its own connection, so the row is a fact about the server, not an inference. TLS 1.0 and 1.1 accepted is a finding worth acting on; they were deprecated by RFC 8996.
Common questions
It says the certificate is valid but my browser complains
Usually the chain, the name or the clock. Check that the intermediate is served, that the host you type is in the SAN list — browsers ignore the CN entirely — and that the device’s date is right. A device with a wrong clock rejects perfectly good certificates.
Can I check an internal server?
No. The connection goes out from our server, and the outbound lane refuses private and loopback addresses. For an internal host, openssl s_client -connect host:443 -servername host gives you the same chain locally.
Why does a shared IP still return the right certificate?
Because the host name is sent as SNI during the handshake, which is how the server knows which certificate to present. That is also why an IP address alone cannot be checked here.
Does it check revocation?
No. OCSP and CRL are not queried, so a revoked but unexpired certificate reads as valid here. That is a real limit: what this shows is what the server served and whether the chain and dates hold.
Feed it from
Certificate Decoder
Parses a PEM or DER certificate or CSR and shows subject, SANs, validity, key usage and chain hints.
DNS Lookup
Queries A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA and PTR records over DoH, with TTL and the DNSSEC bit shown, from Cloudflare or Google.
WHOIS Lookup
Shows domain registration, registrar, nameservers and expiry, plus RDAP data where it exists.
HTTP Header Inspector
Fetches a URL and shows the full response headers, redirect chain, timings and compression used.
Next
These accept what this tool produces, so the result can go straight in.
Certificate Decoder
Parses a PEM or DER certificate or CSR and shows subject, SANs, validity, key usage and chain hints.
CSR Generator
Generates a certificate signing request and its private key from subject fields and SAN entries.
DNS Lookup
Queries A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA and PTR records over DoH, with TTL and the DNSSEC bit shown, from Cloudflare or Google.
Security Header Scan
Grades a site’s HSTS, CSP, frame, referrer and permissions headers and shows what to add.
HTTP Request Builder
Composes and sends a GET/POST/PUT/PATCH/DELETE/HEAD request with custom headers and a body, and shows the status, headers, body and timing — without ever forwarding cookies or Authorization.
Currency Converter
Converts between about thirty currencies at the ECB’s daily reference rates, crossed through the euro, or at a rate you type in.