What is an SSL certificate check?
Every HTTPS host presents a TLS certificate that proves its identity and carries the public key clients encrypt against. A certificate check connects to the host, completes a TLS handshake and reads that certificate: who issued it, which names it is valid for, when its validity window starts and ends, which protocol and cipher were negotiated, and which intermediate certificates complete the chain to a trusted root.
It is the fastest way to find out why a browser warns about a site, to catch a certificate that is about to expire before it breaks automation or monitoring, to confirm that a renewal actually deployed, or to see whether a host still serves a self-signed or hostname-mismatched certificate.
How to use the SSL certificate check
- Enter the hostname you want to inspect, for example example.com. A full URL is accepted and reduced to its host.
- Set the port if you are not checking standard HTTPS, for example 8443.
- Press Check certificate and wait for the TLS handshake to finish.
- Read the verdict badge first, then the days remaining, expiry date, issuer, SAN list, protocol, cipher and chain.
Frequently asked questions about SSL certificates
What do the verdicts mean?
ok means the certificate verifies and has more than 30 days left. expiring means it verifies but expires within 30 days. expired means its validity end is in the past. invalid means it failed a trust check — hostname mismatch, self-signed or untrusted chain, revoked or a handshake error. unreachable means no TLS session could be established at all: the host refused the connection, timed out or does not resolve.
Why is an unreachable host not an error?
Because “this host does not answer on this port” is itself the answer you were looking for. The check reports it as a normal result with a reason code such as ECONNREFUSED or TIMEOUT, so you can tell a dead service apart from a certificate problem.
Why can I not check my internal server?
Private and reserved addresses are blocked on purpose. The request is made from our servers, so allowing it would turn this page into a probe of your internal network. Use a public hostname, or run the check inside your own network.
Why does the certificate show as invalid on a site that works?
A browser can still load a site with an invalid certificate after you dismiss a warning. This tool reports what the certificate actually is — an expired, self-signed or hostname-mismatched certificate stays invalid here even if you can click past it there.
Are the checks private?
The hostname you enter is sent to our API server, which performs the TLS handshake. Do not check internal or confidential hostnames; inspect those from inside your own network.