SSL Certificate Checker
Inspect the TLS certificate any HTTPS site is actually serving: who issued it, exactly when it expires, which domains it covers, and whether the chain is intact. The two-minute check that prevents the classic 'certificate expired at 3 a.m.' outage.
How to use
- Enter the hostname (example.com, the tool connects on port 443).
- Click Run to retrieve the live certificate.
- Check the expiry date, covered domains (SAN), and issuer.
Every HTTPS connection starts with the server presenting a certificate, a signed statement binding a hostname to a public key, issued by a certificate authority the browser trusts. When it expires, browsers show full-page warnings and API clients throw errors. There is no graceful degradation. Expired certificates remain one of the most common self-inflicted outages in the industry, taking down everything from small blogs to national services.
This checker connects to the host and reports what it actually serves: validity dates, the issuing CA, the SAN (Subject Alternative Name) list, the actual set of hostnames the certificate covers, since the SAN list, not the common name, is what browsers validate, and the presented chain. A missing intermediate certificate in that chain is a subtle classic: desktop browsers often repair it silently (via cached intermediates or AIA fetching) while mobile apps, curl, and Python requests fail, 'works in Chrome, fails in production' is very often a chain problem.
Modern practice: certificates from Let's Encrypt last 90 days and must be auto-renewed. The industry maximum for any public certificate is now 398 days. Automated renewal fails silently more often than anyone likes, a cron job that broke months ago, a DNS challenge that stopped validating. Checking the live expiry date from outside, on a schedule, is exactly how you catch that before your users do.
Examples
Input: example.com
Output: Issuer: DigiCert · Valid until 2027-01-15 (188 days) · SAN: example.com, www.example.com · Chain: completeInput: yourapp.in
Output: Issuer: Let's Encrypt (R11) · Valid until 2026-07-26 (14 days), renew now · SAN: yourapp.inFrequently asked questions
Why does my site work in Chrome but fail with curl or in my app?
Almost always an incomplete chain: your server is not sending the intermediate certificate. Browsers repair this from cache. Strict clients do not. Serve the full chain (fullchain.pem, not cert.pem, with Let's Encrypt/certbot).
How early should I renew a certificate?
Automated setups renew Let's Encrypt certs at 30 days remaining. If you see under two weeks left, treat it as urgent, investigate whether your automation silently died.
What is the SAN list and why does it matter more than the common name?
The Subject Alternative Name extension lists every hostname the certificate is valid for. Browsers ignore the legacy common-name field. If api.example.com is not in the SAN list, the cert does not cover it, full stop.
Does this check tell me my TLS configuration is secure?
It verifies the certificate itself, validity, coverage, chain. Protocol-level hardening (TLS versions, cipher suites, HSTS) is a separate concern. Pair it with the security headers scanner for the response-header side.
Related tools
Velona is India's INR-native AI API gateway with 300+ models, UPI top-up from ₹10, no foreign card needed. These tools are free forever.