SSL certificate checker
Reads the certificate a host presents: who issued it, when it expires, which names it covers, and whether the chain verifies.
Checker offline. Follow the manual steps below, they give the same answer.
What it checks
- notBefore and notAfter, with the days remaining.
- Issuer and subject, and whether they are the same, which means self-signed.
- Subject Alternative Name, the list of hostnames the certificate actually covers.
- The chain the server sent, and whether an intermediate is missing.
- The negotiated TLS version and cipher suite.
- Whether an OCSP response was stapled.
What is not stored
This checker runs on a server, and the server is not deployed yet, so the form above is disabled. The manual steps on the procedures below return the same answer from your own machine, and they are what the checker automates.
Limits
- The certificate is read as one client on one connection. A server behind a load balancer can present a different one to the next caller.
- Revocation is reported as the server describes it. Browsers largely soft-fail revocation checks, so a clean result here is not proof.
- Only port 443 on the name you give is read.
Procedures that explain the result
- How to check certificate chain
- How to check if a certificate is self-signed
- How to check SSL certificate expiry
- How to check SSL certificate from command line
- How to check TLS version of a website
- How to test SSL configuration
Put it on your own page
Link to it with the value filled in, and the checker runs as soon as the page opens.
<a href="https://h2check.org/tools/tls-certificate/">SSL certificate checker</a>