Domain SSL Checker
Opens a real TLS connection to the host you name and reports the certificate chain it actually serves.
What this tool does
The SSL checker opens a real TLS connection to the domain you enter — the same handshake your browser performs — and reports exactly what the server sent back. It is a live check, not a lookup in a database, so the answer reflects the certificate that is installed right now.
Because the connection comes from this server rather than your own machine, it sees what an ordinary visitor sees. That distinction matters more than it sounds: your own browser caches intermediate certificates from other sites it has visited, so it can silently repair a broken chain that fails for everyone else. This tool cannot do that, which is precisely why it catches the problem.
How to use it
Type a hostname and press Check. Plain example.com is enough; the default port is 443. To test a service on another port — a mail server, an admin panel, a staging environment — append it: example.com:8443.
Both apex and subdomains work, and a wildcard certificate will be reported against whichever name you asked for.
Reading the result
When something is wrong, a Recommended fixes panel opens directly under the verdict: what the fault is, what it breaks in practice, and the one change that clears it. A host with nothing wrong gets no panel at all. Below that the result is split into eight collapsible sections:
- Certificate Subject — who the certificate is for, including the full Subject Alternative Name list. Browsers validate against SANs alone; the Common Name is ignored.
- Certificate Issuer — which CA signed it, and whether it is self-signed.
- Certificate Properties — serial, signature algorithm, key type and size, validity window, days remaining.
- Certificate Extensions — every X.509 extension decoded, with critical ones marked.
- Certificate Fingerprints — SHA-256 and SHA-1, plus a public key pin.
- SSL/TLS Handshake — protocol version, cipher suite, key exchange, ALPN, and whether the chain validates against a public trust store.
- Certificate Chain — each certificate the server sent, labelled leaf, intermediate or root, with a verdict on whether the chain is complete.
- Raw Certificate (PEM) — the certificates themselves, re-encoded from the handshake, ready to copy or download. The leaf on its own, and the full bundle when more than one was sent. Feed them to the decoder, the key matcher, or
openssl x509.
Under the sections, Create a renewal CSR from this certificate opens the CSR generator with the subject and every SAN of the live certificate already filled in — useful when the expiry date is what brought you here.
Common problems
- Only one certificate in the chain. The intermediate is missing. The site works in your browser and fails on phones, older Androids and API clients. Fix by concatenating the intermediates into the file your server serves.
- NOT TRUSTED but the dates look fine. Usually a self-signed certificate, an incomplete chain, or a CA your system does not trust.
- The hostname is not in the SAN list. The certificate is valid, just not for the name you asked for — common after adding a new subdomain.
- Connection timed out. A firewall is blocking the port, or the host does not speak TLS on it.