DevTools Logo

SSL Certificate Checker

SSL Certificate Checker

Analyze SSL/TLS certificates for any domain and check security details

    Certificate Lookup

    Try:

    Details

    The SSL Certificate Checker performs a deep inspection of the TLS/SSL certificate served by any HTTPS domain, revealing the full chain of trust, cryptographic parameters, and validity timeline that underpin secure web connections. When a browser connects to an HTTPS site, the server presents its digital certificate — a cryptographically signed document that proves its identity and establishes the encryption parameters for the session. This tool initiates a TLS handshake from the browser (via a backend proxy to bypass CORS restrictions on raw socket connections) and extracts every detail from the returned certificate: the subject Common Name and Subject Alternative Names (SANs), the issuing Certificate Authority and its organization, the validity period with start and end dates, the public key algorithm and bit length (RSA 2048/4096 or ECDSA P-256/P-384), the signature algorithm (SHA-256 with RSA, SHA-384 with ECDSA, etc.), the full certificate chain from leaf to root, and any X.509 extensions like Basic Constraints and Key Usage. The tool presents a color-coded status: green for valid, trusted certificates with more than 30 days remaining; yellow for certificates expiring within 30 days; and red for expired, self-signed, or untrusted certificates. A chain-of-trust visualization shows each certificate in the hierarchy from the domain certificate through intermediate CAs to the trusted root, making it easy to identify misconfigured or missing intermediate certificates. The tool also flags known security issues: weak signature algorithms (SHA-1), deprecated key sizes (RSA < 2048), certificates signed by distrusted CAs, and mismatched domain names. Common applications include verifying that a newly installed or renewed certificate is properly deployed, monitoring certificate expiration to prevent unexpected outages, debugging SSL/TLS errors reported by browsers or API clients, and auditing the cryptographic strength of certificates across a company's public-facing domains.

    Examples

    Valid Certificate

    Domain: google.com - Valid until 2024-12-15, SHA-256, 2048-bit RSA

    Wildcard Certificate

    Domain: github.com - Valid, Wildcard cert, Let's Encrypt CA

    Expired Certificate

    Domain: expired-cert.example.com - EXPIRED certificate, last valid 2023-01-01

    Self-Signed Certificate

    Domain: self-signed.local - Self-signed certificate, not trusted

    Examples

    Classify a certificate with 90 days remaining

    Input
    isSelfSigned: false
isValid: true
daysUntilExpiry: 90
    Output
    Valid

    The status logic uses the default Valid badge when the certificate is not self-signed or expired and has more than 30 days remaining.

    Flag a certificate nearing expiry

    Input
    isSelfSigned: false
isValid: true
daysUntilExpiry: 14
    Output
    Expiring Soon

    A positive remaining lifetime of 30 days or fewer produces the Expiring Soon badge.

    Prioritize the self-signed warning

    Input
    isSelfSigned: true
isValid: true
daysUntilExpiry: 365
    Output
    Self-Signed

    Self-signed status takes precedence over the date-based Valid classification.

    About this tool

    The SSL Certificate Checker opens a server-side TLS connection to a domain and port, then displays the peer certificate and the issuer certificates exposed by Node.js. It surfaces the subject, issuer, validity dates, serial number, fingerprint, Subject Alternative Names, extended key usage and a simple chain view.

    Status is derived from a narrow set of rules: a matching issuer and subject Common Name is labeled Self-Signed; an expired certificate is labeled Expired; 30 days or fewer is Expiring Soon; otherwise it is labeled Valid. The connection intentionally disables normal trust rejection so certificates can still be inspected when verification would fail.

    This is an inspection aid, not a full trust validator. The current implementation does not verify hostname matching, revocation, chain signatures or trust anchors, reports key size as Unknown, and uses a placeholder signature-algorithm label. Confirm security-sensitive conclusions with a dedicated TLS client or certificate library.

    How to use

    1. Enter the endpoint

      Provide a hostname and port. Port 443 is the default; pressing Enter in the domain field also starts the lookup.

    2. Check the validity window

      Review Valid From, Valid To and Days Until Expiry. The badge changes to Expiring Soon at 30 days or fewer.

    3. Inspect names and chain

      Check the subject, issuer, Subject Alternative Names and the certificates listed in the Chain tab.

    4. Export the observed data

      Copy the plain-text report or download it for an incident ticket, renewal record or configuration review.

    Use cases

    Triaging a certificate-expiry alert

    Retrieve the presented certificate and compare its remaining lifetime with a monitoring notification.

    Checking SNI on a non-default port

    Inspect the certificate served by a TLS-enabled application running on a port other than 443.

    Reviewing SAN coverage

    Read the Subject Alternative Names exposed by the certificate before a renewal or endpoint rollout.

    Capturing certificate metadata

    Copy or download the observed fields for an operations ticket, inventory record or incident timeline.

    Common mistakes

    Mistake:Reading the Valid badge as proof of a trusted, hostname-matching chain.

    Fix:Treat it as an expiry-oriented status only; verify hostname, signatures and trust anchors with a dedicated TLS validator.

    Mistake:Relying on the displayed algorithm or key size for a cryptographic audit.

    Fix:Do not use those fields for policy decisions: the current implementation hard-codes the algorithm and reports key size as Unknown.

    Mistake:Entering an invalid port and assuming it will be rejected.

    Fix:Enter a numeric port explicitly; nonnumeric input and zero fall back to 443, while parseInt also accepts numeric prefixes.

    Mistake:Assuming the displayed chain has been cryptographically validated.

    Fix:The tool follows issuerCertificate links and calls any chain longer than one certificate complete; validate the actual chain separately.

    Frequently asked questions

    Related guides

    How to Use the SSL/TLS Deep Inspector (A–F Grading)

    Run a live TLS handshake from DevTools backend, interpret the A–F grade, and fix chain, expiry, and protocol findings.

    Why Your TLS Certificate Chain Breaks (and How to Fix It)

    A field guide to 'unable to get local issuer certificate' and friends. What a certificate chain is, why order and intermediates matter, and how to find the broken link in a PEM bundle.

    Reading a PEM Certificate: Subject, Issuer, SANs and Expiry

    What the fields in a PEM certificate mean, why Subject Alternative Names matter more than the Common Name, and how to decode expiry and key usage.

    How to Decode a CSR Before Sending It to a Certificate Authority

    Inspect a Certificate Signing Request before you send it off. Learn what the Subject, SAN, public key and signature mean, and why modern browsers ignore CN in favor of the Subject Alternative Name.

    References & standards

    Related tools

    SSL/TLS Deep Inspector

    Grade TLS configuration with chain trust, protocol, key strength, and expiry checks

    SSL Chain Analyzer

    Paste a PEM certificate bundle and verify the chain order — find missing intermediates, broken links, expired or not-yet-valid certificates, self-signed roots, and duplicates. All in-browser.

    Security Headers Checker

    Grade CSP, HSTS, and related HTTP security headers from a live response

    DNS Propagation Checker

    Compare DNS answers from global public resolvers and see propagation consensus instantly

    WHOIS Lookup

    Lookup domain registration information including registrar, creation date, expiration date, and name servers.