SSL Certificate Check

What is SSL Checker?

SSL Checker takes a domain (or host:port), connects to that server over TLS, and reads the certificate it presents. It shows the subject (CN), issuer, valid-from and expiry dates, days remaining until expiry, the SAN (Subject Alternative Name) list, and the serial number — so you can see at a glance when a certificate expires and which domains it covers.

A TLS handshake can't be performed from browser JavaScript, so this tool has the server open a tls.connect to the entered host on the given port (443 by default), retrieve the peer certificate, then compute whether it's expired and how much time remains. Before connecting it resolves the hostname via DNS and blocks internal/private ranges (SSRF protection), connecting only on allowed ports.

The most common use is expiry monitoring: a negative days-remaining means it's already expired, and a small number means renewal is due. The SAN list tells you which names a single certificate covers (www, apex, subdomains), and the issuer confirms it came from the expected CA (e.g. Let's Encrypt). Because it reads the certificate itself, misconfigured certs — expired or with a name mismatch — are shown as-is.

How to use

1. Enter the domain to check (e.g. example.com). The default port is 443; for a different port, include it, like example.com:8443.
2. Click 'Check Certificate' and the server opens a TLS connection to that host and reads the certificate.
3. Check the status (valid / expired / not yet valid) and days remaining first, then use the issuer, validity period, and SAN list to confirm the certificate was issued for the right domains and by the expected CA.

Frequently asked questions

What does 'valid · N days left' mean?

It's the number of days until the certificate's 'valid to' date. As the number shrinks, renewal is coming due; once past expiry it shows 'expired (N days ago)'. Even with auto-renewal (e.g. Let's Encrypt's 90-day certs), this value confirms the renewal actually happened.

Why does the SAN list matter?

Modern browsers validate against the SAN — not the CN — to check the domain you visited is listed. If you serve www, the apex (e.g. example.com), and several subdomains from one certificate, all those names must appear in the SAN; a missing name causes a name-mismatch error on that domain.

Does it validate the certificate chain or intermediate CA?

This tool reads and displays the leaf certificate the server presents; since its purpose is inspection, it doesn't enforce trust-chain validation (rejectUnauthorized: false). Self-signed, expired, or name-mismatched certs are therefore shown as-is — treat it as a way to inspect certificate contents regardless of whether a browser would trust it.

The connection fails or times out.

That means TLS isn't listening on that host/port, a firewall is blocking it, or no response arrived within 8 seconds. Confirm the port is right (443 for HTTPS, a separate port for other services) and that the domain actually serves TLS.