How do I check a website's SSL certificate?
Enter a domain or hostname into the field above and click 'Check certificate'. The tool connects directly to the server over TLS, retrieves the certificate chain and reports back on its validity, trust and configuration within a few seconds.
What does this tool check?
It reports the negotiated TLS protocol and cipher, the full certificate chain (leaf, intermediates and root), expiry dates and days remaining, whether the certificate matches the hostname, whether the chain is trusted by a public certificate authority, the key type and size, the signature algorithm, HSTS support and whether HTTP traffic is redirected to HTTPS.
What does 'days remaining' mean?
This is the number of days until the certificate's expiry date. Certificates expiring within 30 days are flagged as a warning so renewals can be scheduled before they lapse, and an expired certificate is flagged as a critical issue.
Why does it say the certificate isn't trusted?
A certificate is untrusted when it can't be verified against a public certificate authority – commonly because it's self-signed, issued by an internal or private CA, or because an intermediate certificate is missing from the chain. Browsers will show a warning to visitors in this state unless the certificate is self-signed and trusted locally.
What is a certificate chain?
A TLS certificate is validated through a chain of trust: the server's own ('leaf') certificate, one or more intermediate certificates, and a root certificate held by a trusted authority. If a server fails to serve its intermediate certificates, some clients may fail to validate the connection even though the leaf certificate itself is valid.
What does the legacy protocol support check do?
When enabled, the tool makes separate connection attempts using TLS 1.0, 1.1, 1.2 and 1.3 to see which protocol versions the server still accepts. TLS 1.0 and 1.1 are deprecated and considered insecure – if a server still accepts them, it's flagged as a warning.
What is HSTS and why does it matter?
Strict-Transport-Security is a response header that tells browsers to only ever connect to a site over HTTPS, even if a user types or follows a plain http:// link. Without it, visitors can be exposed to downgrade attacks on their first visit.
Can I check a non-standard port?
Yes. Open the 'Settings' panel to specify a port other than 443 – useful for checking mail servers, internal services or anything else running TLS on a custom port.
What is the custom SNI hostname option for?
Server Name Indication (SNI) tells the server which certificate to present when multiple sites share the same IP address. Use this option to check the certificate for a specific hostname independently of what you typed in the main field – useful when testing a server before DNS has been switched over.
Does this tool store the domains I check?
No. Checks are performed on demand and results are only shown in your browser – nothing is saved.