SSL/TLS Checker
Certificate validity, chain, protocol and days remaining.
Enter a target
e.g. example.com — press ⏎ / ⌘⏎
What is SSL/TLS Checker?
SSL/TLS Checker inspects a server's certificate through a real TLS handshake: validity window, issuer, protocol version, cipher suite, chain length and every name the certificate covers (SAN).
Expired certificates are among the most common causes of outage. Tracking days remaining lets you plan renewal, and continuous monitoring can alert you as expiry approaches.
Chain validation is a separate question: a certificate can be valid while the intermediate isn't served, and some clients then refuse the connection — a site that works in your browser can fail in a mobile app or under curl.
Frequently Asked Questions
9 questionsWhat does "chain could not be verified" mean?
Your server is likely missing intermediate certificates, or the chain doesn't end at a trusted root. Browsers sometimes tolerate it, but many clients reject the connection — serve the fullchain.
When should I renew my certificate?
At least 30 days before expiry. With 90-day certs like Let's Encrypt, set up automated renewal (certbot, acme.sh). You can also track the days-remaining via our monitoring feature.
What is the SAN list?
Subject Alternative Names — every hostname the certificate covers. www and non-www variants plus subdomains must be listed; any name not present triggers a certificate warning.
Do you access my private key?
No. The tool only performs a public TLS handshake and inspects the certificate the server presents; the private key never leaves your server.
My browser says the site is secure but the tool warns about the chain — why?
Browsers often complete a missing intermediate themselves (AIA fetching) or have cached it. curl, Java clients and mobile apps do not. A site that works in a browser can fail for API clients, so a chain warning is a real problem.
What does a wildcard certificate cover?
Exactly one level: *.example.com covers mail.example.com but not a.b.example.com. It also doesn't automatically cover the apex — example.com must be listed in the SAN separately.
What happens when a certificate expires?
Browsers show a full-page interstitial and most API clients refuse the connection outright. Automate renewal, and automate reloading the web server after renewal too.
Which TLS versions should I disable?
TLS 1.0 and 1.1 are deprecated and prohibited by standards like PCI DSS — turn them off. TLS 1.2 can stay for compatibility; prefer TLS 1.3.
What is Certificate Transparency?
Every issued certificate is written to public append-only logs. If an unexpected certificate is issued for your domain you can spot it in CT logs, while a CAA record restricts in advance which CAs may issue at all.