About this tool
Capture scope-limited live TLS evidence before launches, renewals, DNS changes, and incident reviews without treating one server-side handshake as a universal deployment scan.
SSL Certificate Checker performs one bounded server-side TLS handshake to a DNS-selected public address on port 443. It exposes leaf validity, RFC 9525 subjectAltName identity, runtime trust, peer-chain, public-key, fingerprint, negotiated protocol, cipher, ALPN, ephemeral-key, and OCSP-staple presence evidence before users or crawlers encounter a certificate error.
- Pins one DNS-selected public address for one port 443 handshake, requires TLS 1.2 or newer, and records the negotiated protocol, cipher, ALPN, and ephemeral-key evidence.
- Checks exact time validity and RFC 9525 DNS or IP subjectAltName identity without falling back to the legacy common name, then reports this server runtime's trust decision.
- Bounds SAN and peer-chain evidence, records the public key and SHA-256 fingerprint, reports OCSP-staple presence without validating it, and exports versioned JSON evidence.
How to use SSL Checker
Enter a public domain or HTTP(S) URL whose host should be inspected on port 443. Review exact validity dates, full days remaining, RFC 9525 SAN match, this server runtime's trust result, peer-provided chain, public key, protocol, cipher, and fingerprint. Renew, reissue, or correct routing when the certificate is expired, inactive, untrusted, or does not cover the requested host.
When this tool is useful
- Check a domain before launch, migration, or DNS cutover.
- Confirm a renewed certificate covers both apex and www hostnames.
- Review TLS details when users report browser security warnings.
Practical tips
- Renew certificates well before the final week so DNS, CDN, and deployment delays do not create downtime.
- Check every public hostname separately because apex, www, app, and API subdomains can use different certificates.
- Use the fingerprint when documenting certificate changes during incident response or vendor handoff, then verify critical browser and regional paths separately.
Examples you can test
Load an example, compare the result with the expected output, then replace it with your own input.
Check certificate expiry
Example input
example.com
Expected output
Certificate valid-to date and days remaining
Useful before scheduled launches or monthly site-health reviews.
Verify hostname coverage
Example input
www.example.com
Expected output
SAN hostnames and trust status
Hostname mismatches can break browsers even when the certificate itself is not expired.
Validation checklist
- Confirm the certificate has enough days remaining before launch.
- Check that a DNS or IP SAN covers the exact hostname users visit; do not rely on the legacy common name.
- Review the issuer and server-runtime trust result for unexpected certificate authority or chain changes.
- Test apex, www, API, alternate addresses, regions, CDN edges, and custom TLS ports separately when they serve public traffic.
- Document the SHA-256 fingerprint when reviewing certificate rotations.
- Treat OCSP stapling as presence-only evidence here and use a dedicated revocation or CT workflow when required.