SSL Checker: Certificate Chain, Expiry & TLS Version
Check an SSL certificate's chain, expiry, hostname match and TLS version
What this SSL certificate checker tests
When a browser connects over HTTPS it receives the server's certificate and checks three things before showing a padlock: the certificate chains up to a certificate authority it trusts, the certificate covers the hostname in the address bar, and today's date falls inside its validity window. If any check fails, visitors get a full-page warning. This SSL checker runs the same handshake from our server and reports each check separately, so you can see exactly what's wrong — or confirm that everything is right after a renewal or migration.
Enter a hostname and pick a port. Our server resolves the name, refuses private or internal addresses, opens a TLS connection to the resolved IP with SNI set to your hostname, and reads what the server sends. The result shows: whether the chain is trusted (judged against Node.js's bundled Mozilla CA store, with the exact error if not — for example an incomplete chain or a self-signed certificate); whether the hostname matches the certificate's subject alternative names; the issue and expiry dates with days remaining; the issuer; the public key type and size (RSA 2048, EC P-256 and so on); the serial number; and the SHA-256 fingerprint. The full chain as sent by the server is listed in order from the leaf certificate up.
Besides 443 you can check 8443 and the implicit-TLS mail and directory ports — 993 (IMAPS), 995 (POP3S), 465 (SMTPS) and 636 (LDAPS). STARTTLS ports such as 587 and 25 aren't supported because they begin in plain text. Nothing about the check is stored.
Certificate expiry, chain problems and TLS version checks
Certificate expiry is the most common cause of sudden HTTPS outages, and it's getting more important to watch: the CA/Browser Forum has cut maximum public certificate lifetimes to 200 days from March 2026, falling to 100 days in 2027 and 47 days in 2029, so certificates renew far more often than they used to. Use this certificate expiry checker after each renewal to confirm the new certificate is actually being served — a classic mistake is renewing successfully but forgetting to reload the web server, CDN or load balancer, which keeps presenting the old one. The days-remaining badge turns amber under two weeks.
The most frequent chain problem is a missing intermediate certificate. Browsers often hide it by fetching or caching intermediates, but API clients, mobile apps and command-line tools don't, so a site can look fine in Chrome yet fail elsewhere. If the result says "unable to verify the first certificate", configure your server to send the full chain (for Nginx, point ssl_certificate at the fullchain file). A hostname mismatch usually means the request reached the wrong virtual host or the certificate lacks a SAN for that name — www and the bare domain need to be listed separately unless a wildcard covers them.
The TLS version check shows the protocol negotiated with our client. TLS 1.3 and 1.2 are current; TLS 1.0 and 1.1 were deprecated in RFC 8996 and modern clients refuse them, so a server that can only speak those will fail the handshake here as well. The negotiated cipher and ALPN protocol (h2 means HTTP/2 is available) are shown alongside. This is a single handshake, not a full scan of every protocol and cipher a server allows.
How to use the SSL Checker: Certificate Chain, Expiry & TLS Version tool
- 1
Enter a hostname
Type a domain such as example.com — https:// and paths are stripped automatically.
- 2
Choose the port
443 by default; 8443, 993, 995, 465 and 636 are also available for implicit-TLS services.
- 3
Run the check
Our server performs a TLS handshake with SNI and reads the certificate chain.
- 4
Review the badges
Trust, hostname match, days to expiry and TLS version are flagged green, amber or red, with full certificate and chain details below.
Frequently asked questions
Does a trusted result mean my site is secure?
It means the certificate is valid, trusted, matches the hostname and isn't expired — the checks browsers make. It doesn't test the application, security headers or every cipher the server accepts.
Why does my site work in Chrome but fail here?
Usually a missing intermediate certificate. Browsers can fill the gap from cache; Node.js, curl and many apps can't. Serve the full chain from your web server.
Which CA list is used to decide trust?
Node.js's bundled Mozilla root store — the same family of roots used by Firefox and most Linux distributions. Private or internal CAs will show as untrusted.
Can I check an internal server?
No. Hostnames that resolve to private, loopback or other internal addresses are refused so the checker can't be used to probe internal networks.
Why aren't ports 587 or 25 supported?
They use STARTTLS, where the connection starts in plain text and upgrades later. This tool performs a direct TLS handshake, which works only on implicit-TLS ports.
Related on TechLogHub
Related Network Tools
cURL to Fetch Converter
Convert cURL commands to JavaScript fetch() calls instantly
cURL to Axios Converter
Convert cURL commands to Axios request code in seconds
Test API Online: REST Client with cURL Export
Send HTTP requests to CORS-enabled APIs from your browser and copy them as cURL
Mock REST API with Fake Users, Posts and Todos
Free fake REST API with users, posts, todos, comments and products for testing
HTTP Headers Viewer
View HTTP response headers for any URL
User-Agent Parser
Parse and decode user-agent strings
Get the next tool before you need it
One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.