SSL Checker
Hostname
Read live from the certificate the server presents on port 443.
Certificate presented by
-
Certificate
Subject, issuer and validity.
Connection
Protocol, cipher and chain.
Subject alternative names
Every hostname this certificate covers.
Notes
No certificate checked yet
Enter a hostname to read the certificate it serves, including expiry and covered names.
What this check reads
The handshake is performed from this server, and the certificate the peer presents is read directly. Nothing is cached, so the result describes the certificate being served at this moment rather than one from an earlier scan.
A verified handshake is attempted first. If the chain does not validate, the connection is retried without verification purely to report what the server is actually sending, which is exactly the information you need when a browser is showing a warning.
The four things that make a certificate fail
| Problem | What the browser shows |
|---|---|
| Expired | A full-page warning. No override is offered in most browsers for expired certificates. |
| Name mismatch | The certificate does not cover the hostname, so the browser cannot confirm identity. |
| Untrusted issuer | A self-signed or private CA certificate, or a missing intermediate in the chain. |
| Revoked | The issuer has withdrawn the certificate, usually after a key compromise. |
A chain that returns only the leaf certificate usually means an intermediate is not being served. Some browsers fill the gap from their own cache, which is why a site can look fine for you and fail for a first-time visitor.
Wildcards and subject alternative names
A wildcard such as *.example.com covers exactly one label. It matches www.example.com and not a.b.example.com. Every other covered name appears in the subject alternative names list, which is what browsers actually check; the common name is legacy.
If you add a subdomain and see a certificate warning, the first thing to check is whether the name is in the SAN list.
Frequently asked questions
How long before expiry should I renew?
Thirty days is a comfortable margin. Public certificates now have a maximum lifetime of 398 days, so renewal is frequent enough that automation beats a calendar reminder.
Does an expired certificate break the site?
Browsers refuse the connection with a warning page that most users will not click through. API clients usually reject it outright.
What is a certificate chain?
The path from your server certificate up to a root the browser already trusts. The server must send the intermediate; the root is usually already installed.
Why does my certificate work in one browser and not another?
Either the trust store differs, or a missing intermediate is being supplied from one browser cache and not the other. Serving the full chain fixes it.
Is TLS 1.3 required?
Not required, but recommended. TLS 1.2 is still acceptable; TLS 1.0 and 1.1 are deprecated and blocked by major browsers.