DomainDNSCheck

SSL Certificate Checker

Enter a hostname to inspect the certificate it presents over HTTPS. The checker connects to port 443, reads the certificate chain and tests whether browsers would trust it.

  • Web & SSL
  • Live check
  • Free, no sign-up
  • Results are not published

For example example.com — URLs and email addresses are accepted too.

At a glance

What it checks
Inspect the certificate served on port 443: validity dates, hostname match, chain trust, protocol and key.
Data source
A direct TLS connection to port 443 of a validated public address.
Freshness
Live check; results are cached for up to 1 hour
Limits
Checks the certificate served to our servers; a CDN or load balancer can serve different certificates elsewhere. Methodology
Cost
Free, no account needed

Understanding the result

What the checker does

The tool resolves the hostname, confirms the address is public, and performs a TLS handshake on port 443 using Server Name Indication (SNI) so the server returns the certificate for that exact name. It completes two handshakes: one to capture the certificate chain and connection details even if something is wrong, and one with full verification against a standard trust store to confirm whether the chain is trusted.

This is an observational check of a single connection. It does not enumerate cipher suites, test for protocol vulnerabilities or scan other ports.

Findings explained

  • Connection: whether the handshake succeeded and which protocol was negotiated. Timeouts and refused connections are reported as FAIL.
  • Expiry: PASS with 30 days or more remaining, INFO between 14 and 30 days, WARNING under 14 days, FAIL if expired or not yet valid.
  • Hostname: PASS if the name matches a Subject Alternative Name on the certificate. Wildcards such as *.example.com cover exactly one label, so they match www.example.com but not example.com or a.b.example.com.
  • Trust: PASS when the chain verifies. A self-signed certificate, an incomplete chain or an unknown issuer is a FAIL.
  • Protocol: TLS 1.3 and TLS 1.2 pass; anything older fails.
  • Key and signature: RSA keys under 2048 bits, EC keys under 256 bits and SHA-1 or MD5 signatures fail.

The details panel lists the subject, issuer, validity dates, serial number, SHA-256 fingerprint, cipher and each certificate in the chain.

Common problems and fixes

Incomplete chain. The server sends its own certificate but not the intermediate certificate that links it to a trusted root. Some browsers work around this, but many other clients do not. Configure the server with the full chain file your CA provides.

Hostname mismatch. Often the certificate covers www.example.com but not example.com, or the server returns a default certificate because SNI is not configured. Reissue with all names you serve, or fix the virtual host.

Unexpected expiry. Automated renewal can fail silently after DNS, firewall or CAA changes. Check the renewal logs and confirm that validation requests can reach the server.

Related checks

A valid certificate is only part of HTTPS. The HTTP Status & HTTPS Checker confirms that HTTP redirects to HTTPS, and the HTTP & Security Headers tool reviews HSTS. For background on chains and trust, read How SSL certificates work.

Frequently asked questions

Can I check a port other than 443?

No. The checker only connects to port 443 of the hostname you enter, which is the standard HTTPS port. Mail and other TLS services on different ports are out of scope.

My browser shows the site as secure, but the checker reports a chain problem. Why?

Browsers sometimes fetch or cache missing intermediate certificates, which hides the issue. Other clients, including many apps, command-line tools and payment integrations, will fail. Serving the full chain fixes it for everyone.

Why can't I check an internal server?

For safety, the tool refuses hostnames that resolve to private, loopback or other reserved addresses. It can only test servers reachable on the public internet.

Does a valid certificate mean the site is safe?

It means the connection is encrypted and the certificate was issued for that name. It says nothing about who runs the site or whether its content is trustworthy.