Security
SSL/TLS Certificate Checker
Enter a public host and an optional port. One TLS connection is opened, the certificate the server presents is read, and you see the issuer, the names it covers, the protocol, and how many days remain before it expires. Private addresses are refused. The result is not stored.
Quick start
- 1
Enter the host
Use a public host such as example.com, or paste an https URL. Private and local addresses are refused.
- 2
Set the port
443 is the default. Change it only when the certificate is served on another port.
- 3
Check
The page opens one connection and reads the certificate the server presents.
- 4
Read the result
See whether the name matches, when the certificate expires, and which certificates are in the chain. Copy or download JSON if you need a record.
Features
Live certificate
Read the certificate from the handshake, including subject, issuer, serial, and the names it covers.
Expiry
See the valid-from and valid-until dates, and whether the certificate is expired or inside 30 days of expiry.
Name and chain
Check that the host name matches, then read the protocol, cipher, and the certificates in the chain.
Specifications
- Handshake
- TLS 1.2, one connection
- Port
- 443 by default
- Status
- Valid, expiring, expired, name mismatch
- Privacy
- Not stored
Use cases
- Confirm a certificate before it expires.
- See the names a certificate covers.
- Check the issuer and protocol for a public site you operate.
Frequently asked questions
Does this grade the server?
No. It reads the presented certificate, the negotiated TLS 1.2 cipher, and the chain. It does not probe for weak ciphers.
Why might a TLS 1.3-only host fail?
The certificate in a TLS 1.3 handshake is encrypted. The checker asks for TLS 1.2 so it can read the certificate in the clear.