SSL Certificate Checker

This SSL certificate checker opens a real TLS handshake to the host on port 443 and reports the certificate the server presents. An SSL/TLS certificate proves that the HTTPS server is presenting a certificate for the hostname you entered and lets browsers encrypt the connection. The checker confirms whether the certificate matches the hostname, it is currently valid (issued in the past and not expired), and it chains to a trusted root in the checker's trust store.

The chain of trust walks from the leaf certificate for the domain, through one or more intermediate CA certificates, up to a self-signed root . A browser only trusts a site if every link in that certificate chain validates. Short-lived certificates, including many Let's Encrypt certificates, are normal. What matters is that ACME renewal happens before the SSL expiration date.

The connection details also show the negotiated TLS version, cipher suite , key exchange, signature algorithm, Subject Alternative Names, and whether the server stapled an OCSP response during the TLS handshake.

A working HTTPS site: example.com

A check of example.com returns a result shaped like this. Dates, issuer, and cipher change whenever the certificate is renewed or the server configuration changes:

Certificate   Valid · Trusted chain · TLS 1.3
Common name   example.com
SANs          example.com, *.example.com
Key           ECDSA · P-256
Signature     SHA-256 with ECDSA
Cipher        TLS_AES_256_GCM_SHA384
Chain         leaf → intermediate CA(s) → root

Test hosts with known certificate problems

The public badssl.com project runs hosts with deliberately broken certificates:

• expired.badssl.com — the expiry check shows Certificate expired, days left is negative, and the banner shows Invalid.
• wrong.host.badssl.com — the hostname check warns: the certificate covers *.badssl.com, and a wildcard matches only one label.
• self-signed.badssl.com — the chain has a single certificate marked Self-signed, so the chain check warns.
• incomplete-chain.badssl.com — the server sends only the leaf certificate. Some browsers still load this site because they fetch the missing intermediate themselves; many API clients do not.

The five security checks

• Hostname matches certificate — the host must be listed in the SANs (or the common name when there are none). *.example.com covers www.example.com but not example.com or a.b.example.com.
• Chain of trust complete — passes when the chain verifies against the trust store or the server sent at least one certificate above the leaf. The Valid and Trusted chain badges are stricter: they need a verified chain, a hostname match, and valid dates.
• Not expired — today is between the Issued and Expires dates.
• Strong signature — the leaf is signed with SHA-256/384/512, ECDSA, RSASSA-PSS, Ed25519, or Ed448; SHA-1 warns.
• OCSP stapling enabled — the server attached an OCSP response to the handshake. Off is not an error by itself: CAs that no longer run OCSP responders, such as Let's Encrypt, issue certificates that cannot be stapled.

Other fields

• Days left — whole days until Expires; it turns to a warning color at 30 days or fewer.
• Issuer and Issuing CA — the CA organization, and the name of the certificate that signed the leaf. An empty Organization is shown as DV certificate: domain-validated certificates carry no company name.
• Protocol, cipher, key exchange — what was negotiated for this one connection, not every version or cipher the server supports. Key exchange can be blank on some TLS 1.3 connections.
• Chain of trust and PEM — the root usually comes from the checker's trust store, not the server. A last entry labelled Intermediate usually means a cross-signed certificate whose issuer is not listed. The PEM block holds the same certificates for openssl x509 -noout -text.

Use this HTTPS certificate checker after changing DNS, moving a site behind a CDN, renewing a certificate, or debugging browser warnings. The most common issues are expired certificates, hostname mismatch errors, missing intermediate certificates, self-signed certificates, and services that do not answer TLS on port 443.

If a hostname mismatch appears, compare the host you entered with the certificate common name and SAN entries. If the certificate chain checker warns, reinstall the full chain from your certificate authority. If the certificate expiry checker shows a short renewal window, verify that your ACME client or hosting provider will renew before the date shown in the result.

• After a renewal — confirm the new Expires date is actually being served; many web servers keep serving the old certificate until they are reloaded.
• Before a DNS or CDN switch — check that the new endpoint's SANs include every hostname you are moving, then verify records with the DNS lookup.
• Domain audits — pair certificate expiry with domain expiry from the WHOIS lookup; both lapse on their own schedule.

"Couldn't reach" the host

The checker gives up if no TLS handshake completes on port 443 within 8 seconds. Typical causes: DNS pointing elsewhere, a firewall, HTTPS on another port (the checker always uses 443), or a server that only offers TLS 1.0 or 1.1, which the checker does not accept.

Hostname mismatch

Reissue the certificate with the missing name. A leading www. is removed from the input, so entering www.example.com checks example.com. To test the www name itself, run openssl s_client -connect www.example.com:443 -servername www.example.com.

Chain warning on a new certificate

The server is usually sending the leaf without its intermediate. Configure the full chain file from your CA (for Certbot, fullchain.pem rather than cert.pem) and reload the server. The SSL certificate chain guide explains why this breaks curl, Java, and mobile apps but often not desktop browsers.

The old certificate is still served

Reload the web server or proxy after renewal. Behind a CDN or load balancer, the result shows the edge certificate, which can differ from your origin's.

• It makes one connection to port 443 of the address the hostname resolves to; other servers behind the same name can serve different certificates.
• It does not enumerate supported TLS versions or cipher suites or scan for TLS vulnerabilities.
• It reports whether an OCSP response was stapled, but does not check revocation status through OCSP or CRLs.
• Trust is judged against the checker's own trust store; older devices or private corporate roots can give a different verdict.
• It does not inspect HTTP behavior such as redirects, HSTS, or security headers, and lists only DNS names from the SAN extension, not IP address entries.