SSL Certificate Checker

// What is tested

• A live TLS handshake to the host on port 443, using the hostname for SNI so virtual-hosted sites present the right certificate.
• The leaf certificate: subject, issuer, validity dates, days remaining until expiry, and the subject alternative names it covers.
• The chain presented by the server, walked from the leaf up to the root.
• The negotiated TLS protocol version and cipher suite.
• Whether the certificate covers the hostname requested.

// Data sources

The server itself

Everything reported comes from the certificate the host presents during the handshake. No certificate database or third party is consulted.

// Limits

• Certificate validation is deliberately not enforced on connect. An expired, self-signed or mismatched certificate would otherwise abort the handshake, and reporting on exactly those cases is the point of the tool. The result describes what was presented; it is not a browser trust decision.
• Revocation is not checked. A certificate revoked through OCSP or a CRL still appears valid here if its dates are current.
• Port 443 only, over http/https targets. The connection is subject to an eight-second timeout, so a slow or filtered host reports as unreachable rather than as insecure.
• The address is resolved and then pinned for the connection, so a host behind round-robin DNS or a CDN is checked at one edge node. Another node may present a different certificate.
• This is not a full TLS configuration audit. Protocol and cipher are reported, but weak-cipher grading, forward secrecy and known protocol vulnerabilities are not assessed.