SSL/TLS Certificate Checker

What this SSL checker tests

Enter a hostname and this tool opens a real TLS connection to port 443, inspects the certificate the server presents during the handshake, then opens separate connections to find out which protocol versions the server is willing to negotiate. It also checks whether the plain HTTP version of the site redirects to HTTPS, which is where a surprising number of otherwise well-configured sites fall down.

Certificate expiry

The most common TLS incident is not an attack — it is a certificate nobody renewed. When one lapses, every visitor hits a full-page interstitial warning, and most of them leave. This report gives you the exact expiry date and the days remaining, and escalates the severity as that number falls. If renewal is still a manual calendar reminder for you, that is the thing to fix, not the certificate.

Trust, hostname and the certificate chain

A certificate has to do three things: match the hostname you are visiting, chain back to a root your visitors already trust, and still be within its validity window. This tool separates those failures out rather than reporting one vague error, because the causes are completely different. A hostname mismatch means the wrong certificate is installed; an untrusted chain usually means a missing intermediate.

That last one deserves attention because it hides. Browsers often recover from a missing intermediate by using a cached copy or fetching it, so the site looks fine to you while API clients, mobile apps and server-to-server calls fail. This checker reports exactly how many certificates the server sent, so you can see the problem before your integrations do.

Protocol versions

Each version is tested with its own connection, forcing that version specifically. TLS 1.2 and 1.3 are what you want; TLS 1.0 and 1.1 should be refused. Where this checker cannot test the legacy versions — modern TLS libraries often refuse to speak them at all — it says so explicitly rather than reporting a pass it did not actually observe.

Keys and validity periods

RSA keys below 2048 bits are considered breakable and are rejected by current browsers and certificate authorities. The tool also flags certificates issued for more than 398 days, which is the maximum lifetime browsers accept for a publicly trusted certificate — a longer one usually means it came from a private CA, which is fine internally but will not be trusted by the public internet.

A reasonable TLS configuration

Most of what this tool checks comes down to a handful of server settings. The shape you are aiming for:

# Minimum protocol version — drop 1.0 and 1.1
ssl_protocols TLSv1.2 TLSv1.3;

# Send the full chain, not just the leaf certificate
ssl_certificate /path/to/fullchain.pem;
ssl_certificate_key /path/to/privkey.pem;

# Prefer forward-secret suites
ssl_prefer_server_ciphers off;

# And redirect plain HTTP, then tell browsers not to try it again
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

The single highest-value change, if you only make one: automate renewal. Certificates that are renewed by hand are the ones that expire, and they almost always expire at a weekend.

What the browser error actually means

Most people arrive at a tool like this because a browser threw a warning at them. The error strings are not especially helpful, so here is what each of the common ones maps to in the report above.

• NET::ERR_CERT_DATE_INVALID — the certificate has expired, or has not started yet. Check the expiry line. This one also fires when the visitor's own clock is badly wrong, so if the report shows plenty of validity left, suspect the client.
• NET::ERR_CERT_COMMON_NAME_INVALID — the certificate is valid, but not for the hostname being visited. Compare the hostname against the “Valid for” list in the certificate detail.
• NET::ERR_CERT_AUTHORITY_INVALID — the chain does not lead to a root the browser trusts. Usually a self-signed certificate, or a missing intermediate. The report distinguishes those two.
• SSL_ERROR_NO_CYPHER_OVERLAP / ERR_SSL_VERSION_OR_CIPHER_MISMATCH — the client and server share no protocol version or cipher suite they will both accept. Check the protocol support table; a server pinned to TLS 1.0 will now produce this in every modern browser.
• NET::ERR_CERT_REVOKED — the CA has revoked the certificate. Reissue it, and treat the private key as compromised unless you know exactly why it was revoked.

Why the certificate is only half of it

A valid certificate proves the connection is encrypted and that you are talking to the host you think you are. It says nothing about whether that host is safe. Phishing sites have had valid certificates for years — free automated issuance means the padlock is table stakes, not a trust signal. The certificate is the floor, and the headers, cookies and application behind it are where the actual security lives.