Checkers & Validators
SSL / TLS Certificate Checker
Inspect a site's TLS certificate - issuer, expiry, SANs, protocol and cipher.
Hostname
Opens a live TLS handshake on port 443 and reads the peer certificate. Only plain hostnames are accepted - no schemes, no paths, no non-standard ports.
About this tool
Enter a hostname (e.g. example.com) to see its live TLS certificate: subject (Common Name), issuer, valid-from and valid-to dates, days remaining until expiry, all Subject Alternative Names, the negotiated TLS protocol version, cipher suite and any red flags (self-signed, expired, host mismatch, wildcard usage). Backed by a small server-side probe that opens a TCP + TLS handshake to port 443 and reads the peer certificate - no third-party APIs, no CT-log scraping. Handy for one-off checks before renewing, or for confirming that a Let's Encrypt / ACME rotation actually landed on the live server.
FAQs
What information can this show that I can't get from my browser's padlock?
The browser shows the leaf certificate and the CA that signed it. This tool exposes the exact protocol version negotiated (TLS 1.2 vs 1.3), the cipher suite, the full SAN list (so you can see which other hostnames share the cert), and days-to-expiry as a plain number - useful in a script or a monitoring context.
Does it check certificate transparency logs or CAA records?
No. This checker only reports what the server actually presents on the wire during a TLS handshake. For CT-log history use crt.sh, for CAA use a DNS tool. Keeping the tool narrow means it works fast and doesn't need external APIs.
Why does it flag my perfectly valid cert as 'wildcard'?
That's not a warning, it's a label. Wildcard certificates (*.example.com) are legitimate and common. The flag is there so you can tell at a glance whether the certificate covers the exact host you typed or a wildcard parent - which matters when a cert is provisioned per-host (Let's Encrypt) vs. shared across a whole domain.
Can I check a non-standard port or a self-signed cert?
Only port 443 is supported. Self-signed certificates are handled fine - they'll show up with a 'self-signed' flag and no chain of trust to a public CA. Rejecting self-signed would defeat the purpose of inspecting them.
How is 'days until expiry' rounded?
Down to the nearest whole day, calculated from now (UTC). A cert that expires in 6 hours reports 0 days remaining. Rotate cron jobs to run at least 14 days before expiry, not 1 - CDN caches and DNS TTLs can extend the window that a stale cert is still being served.