// TLS
SSL Certificate Checker
Run the same handshake your browser performs, and see every answer it gets back.
// Reading a TLS certificate
Every HTTPS connection begins with the server presenting a certificate, and your browser checking three things in quick succession: that it was issued by an authority the browser trusts, that it has not expired, and that it actually covers the hostname you typed. If any one of those fails you get a full-page warning instead of the site. This tool performs the same handshake and reports each answer separately, which is the quickest way to find out which of the three is broken.
Expiry is the most common failure by a wide margin. Certificates are short-lived now — 90 days is typical and the industry is moving shorter — so renewal has to be automated. The days-remaining figure is the number to watch; if you are still renewing by hand, anything under 30 days needs attention the same day.
A hostname mismatch is next. A certificate lists the names it covers in its Subject Alternative Name field, and a wildcard such as *.example.com covers exactly one label: it matches www.example.com but not a.b.example.com, and it does not match the bare example.com unless that name is listed too. The covered-hostnames list on this page is that field in full.
Third is an incomplete chain. Your certificate is signed by an intermediate, which is signed by a root your browser already holds. Servers are expected to send the intermediate; browsers do not go looking for it. A site that works in one browser and fails in another nearly always has this problem, because some clients cached the intermediate on an earlier visit and others did not.
One thing a certificate cannot tell you is whether the site is honest. It proves control of a domain and it encrypts the connection — nothing more. Phishing sites routinely hold perfectly valid certificates, so read the padlock as 'nobody else is reading this connection', not as an endorsement of who is on the other end.
// Frequently asked questions
- What happens when a certificate expires?
- Every visitor gets a full-page security warning and most will leave immediately. There is no grace period. Automate renewal; if you are doing it by hand, act at 30 days rather than waiting for the alert.
- Why does my certificate work in Chrome but fail on a phone or in curl?
- Almost always a missing intermediate certificate. Some clients cached the intermediate from an earlier connection and can complete the chain anyway; others cannot. Configure your server to send the full chain.
- Does a wildcard certificate cover sub-subdomains?
- No. *.example.com matches shop.example.com but not eu.shop.example.com, and it does not cover the bare example.com unless that name is listed separately on the certificate.
- Is a free certificate less secure than a paid one?
- No. The encryption and the domain-control validation are identical. Paid certificates buy warranties, organisation-validated identity details and support — not stronger cryptography.
- Can I check a mail server or an internal host?
- This tool checks TLS on ports 443, 80 and 8443 for publicly resolvable hosts only. Internal hostnames and private IP ranges are rejected deliberately, so it cannot be pointed at networks it should not reach.