TLS/SSL Checker

This checker validates the HTTPS setup of a hostname: what the server negotiates, which certificates it presents, which names those certificates cover and when they expire. It is the first thing to run when a browser shows a certificate warning, when a handshake fails from one client but not another, or when you need to confirm a renewal actually took effect.

Behind the button the tool opens a TLS connection to the host, completes the handshake and reports what the server actually sent: the negotiated protocol version and cipher suite, the ALPN protocol agreed, and every certificate presented in the order it was presented. That last detail matters more than it sounds. Most certificate problems are chain problems, and a chain problem is invisible if you only look at the leaf certificate — which is exactly what a browser shows you when you click the padlock.

A client trusts a certificate when it can build a path from the leaf up to a root it already holds in its trust store. Public CAs almost never sign directly from a root; there is at least one intermediate in between, and it is the server’s job to send it alongside the leaf. Forget to install it and the site works perfectly in Chrome on your laptop — because Chrome cached that intermediate from another site, or fetched it through the AIA extension — and fails outright in a Java client, an older Android device, or curl on a CI runner. If the chain shown here contains a single certificate, that is your bug.

Hostname mismatch is the other classic. Browsers stopped honouring the Subject Common Name years ago and match only against the Subject Alternative Name list. A certificate issued for example.com with no www.example.com SAN throws a name-mismatch error the moment someone lands on the www host, and that is a very common outcome of an automated issuance that only covered the apex. Wildcards cover exactly one label: *.example.com matches app.example.com but not example.com itself and not a.b.example.com.

Expiry is boring and still causes more outages than any interesting attack. Let’s Encrypt certificates last 90 days, the industry is moving toward much shorter lifetimes, and manual renewal does not survive that cadence — automate with ACME and alert on days remaining rather than on a calendar entry. Check the dates on the whole chain, not just the leaf: an intermediate can expire before your certificate does, and lapsed cross-signed roots have quietly broken large numbers of sites for older clients while working fine on modern ones.

On protocol and cipher: serve TLS 1.2 and 1.3. TLS 1.0 and 1.1 were formally deprecated by RFC 8996 and removed from browsers in 2020, and anything involving RC4, 3DES, MD5 or export-grade key sizes should be long gone. If a compliance scan flags you and this checker reports TLS 1.3, or TLS 1.2 with an ECDHE key exchange and an AES-GCM or ChaCha20 cipher, you are generally in reasonable shape. Note the limitation though: it reports what your server chose for this one connection, not the complete list of everything it would accept.

Results can legitimately differ from what your browser shows. CDNs serve different certificates from different points of presence, SNI decides which certificate is offered on a shared address, and a staging origin may be presenting something entirely different from the edge. Test the exact hostname your users type — www and apex separately, and each subdomain that has its own certificate — and read the result alongside the DNS and redirect chain rather than on its own.

What this does not do: grade your configuration against a scoring rubric, enumerate every supported cipher suite by brute force, check certificate transparency logs, verify OCSP stapling in depth, or reach services behind mutual TLS or on non-standard ports. It answers the four questions behind the overwhelming majority of real HTTPS incidents — is the chain complete, is the name right, when does it expire, what did we negotiate. The connection is made from our server, so the result reflects our network path and our client’s capabilities, not your laptop’s.