SSL certificate checker
Check the TLS certificate a domain is actually serving: expiry date, issuer, hostname coverage and chain length. Reads the live handshake, not a cached database.
Reads the certificate straight from a live TLS handshake, so you see what browsers see — not what a certificate-transparency log says was issued.
Monitor this automatically
Get an email 30, 14, 7 and 1 days before this certificate expires. Add as many domains as you like — useful if you look after client sites and would rather not find out from a customer.
What this checks
- Expiry — the real
notAfterfrom the served certificate. - Hostname coverage — whether the domain is in the SAN list or matches a wildcard.
- Issuer — which CA signed it.
- Chain length — how many certificates the server sends. A chain of one usually means a missing intermediate, which breaks some clients even when browsers cope.