Validity period
Start date, expiry and time remaining.
← Back to all tools
SSL Checker
Inspect a certificate’s validity, hostname match and trust verification.
What this check inspects
Certificate details and the TLS connection observed by this checker.
Hostname match
Compare the hostname with certificate SANs.
Certificate trust
Validate the chain using this checker’s trust store.
TLS connection
Show the negotiated protocol and cipher.
A negotiated TLS version is not a complete list of supported protocols.
How it works
A quick overview of the process used by this tool.
- Enter a hostname and portProvide the target hostname, and a port if it is not 443.
- Retrieve the certificate and verify trustThe certificate is read first. Trust is checked separately against this checker’s trust store.
- Review findings and technical detailsValidity, hostname match, trust and the negotiated TLS connection stay separate.
Frequently asked questions
Find answers to common questions about our SSL checker.
What does certificate trust mean?
Trust means this checker could build a path from the certificates the server presented to a root in its own trust store. Reading the certificate is a separate step. A different client can trust a different set of roots.
Why can a hostname mismatch occur?
The name you entered has to match a dNSName SAN, or an iPAddress SAN when you enter an IP. The common name is not used as a fallback. A wildcard matches only one whole label on the left.
Is a missing root certificate a problem?
A server often omits the root because the client already has it. That omission is not a failure by itself. A failure is when the presented certificates cannot be verified to a trust anchor.
Does this check inspect revocation?
No. OCSP, CRLs, OCSP stapling and Certificate Transparency are not checked. The report shows those items as Not checked.