SSL Certificate Checker

About this tool

This SSL checker opens a real TLS connection to a domain and reports what its certificate actually presents — not cached or third-party data. You get the issuer, the subject, the validity dates and days remaining, the serial number and SHA-256 fingerprint, every domain listed in the Subject Alternative Names, and the negotiated TLS version and cipher suite. The full certificate chain is shown from the leaf up through intermediates to the root, which makes it easy to spot a missing intermediate — one of the most common causes of a certificate that works in one browser but fails elsewhere. You can check a non-standard port such as 8443 by adding it after the domain. Checking a certificate requires a server-side connection, so this one tool runs on our server rather than in your browser; we do not store the domains you look up.

How to use

  1. Enter a domain, optionally with a port, for example example.com:8443.
  2. Press Check and wait a moment for the live TLS handshake.
  3. Review the expiry date, days remaining, and the full certificate chain.
  4. Check the SAN list to confirm the certificate covers the hostname you use.

Common use cases

  • Confirming a certificate before or after renewing it
  • Diagnosing why some clients report an untrusted or incomplete chain
  • Monitoring how many days remain until expiry
  • Verifying that a certificate covers all the hostnames it should

Frequently asked questions

What does this tool check?

It connects to the domain and reports the certificate's issuer, validity dates, days remaining, the full chain and the negotiated TLS version and cipher.

Why does a valid site show a warning?

Common reasons are a certificate expiring soon, an incomplete chain or a hostname mismatch. The result explains which one applies.

Is this check done in my browser?

No — checking a TLS certificate needs a server-side connection, so this tool makes the request on the server. We don't store the domains you check.

What does an incomplete chain mean?

The server sent its own certificate but not the intermediate that links it to a trusted root. Browsers often fill the gap from cache, so it works for you but fails for others. Installing the full chain on the server fixes it.

How early should I renew a certificate?

Renew well before the expiry date — commonly 30 days ahead — so a failed automated renewal still leaves time to react. The days-remaining figure here makes that easy to watch.