What is an SSL certificate check?
An SSL certificate check connects to a host over TLS and reads the certificate it presents. Checking example.com, for example, returns a leaf certificate naming example.com in its subject, an issuer such as Example CA, a validity window with a start and end date, a SHA-256 fingerprint, and a SAN list that may add www.example.com. It also reports the negotiated protocol, such as TLS 1.3, and the cipher chosen.
The result also walks the chain: the leaf is signed by an intermediate, which a trusted root signs, and every link must verify for a browser to accept the certificate without a warning. The days-remaining figure matters most in production: a certificate with 14 days left is valid but about to break automation. Use the check to confirm a renewal deployed, catch an expiry early, or explain a hostname mismatch.
How to use the SSL certificate check
- Enter the hostname to inspect, for example example.com; a full URL is reduced to its host.
- Change the port only if you are not checking standard HTTPS on 443.
- Wait for the TLS handshake, then read the verdict and days remaining.
- Review the issuer, SAN list, protocol, cipher and the full chain.
Frequently asked questions about SSL certificates
What do the verdicts mean?
Valid means the certificate verifies with more than 30 days left; expiring means it verifies but ends within 30 days; expired, invalid and unreachable cover a past end date, a failed trust check and a host that never completed a handshake.
Why is an unreachable host not an error?
A host that does not answer on the port is itself the answer; the check reports a reason code such as ECONNREFUSED or TIMEOUT so you can tell a dead service from a certificate problem.
