Skip to content
Webmaster Tools
SecuritySSL Inspector

SSL Certificate Checker

Certificate chain and expiry.

About the SSL Certificate Checker

This tool opens a TLS connection to a host, reads the certificate chain the server presents, and verifies it the way a client would: is the chain trusted, does the certificate cover the host name, and how many days are left before it expires. It also reports the negotiated TLS version, cipher suite, ALPN protocol (such as h2), the IP it connected to, and the handshake time.

Every certificate in the chain gets its own card with subject, issuer, validity dates, key algorithm and size, signature algorithm, serial number and Subject Alternative Names. Certificates with fewer than 21 days left are flagged. Port 443 is used unless you add another, so you can also check services like mail.example.com:993. Loopback and private addresses are not allowed.

How to use it

  1. Enter a host name, optionally with a port (example.com or example.com:8443). Pasting a URL works too.
  2. Select Inspect.
  3. Check the summary badges, then expand the chain to see each certificate.

Examples

Common questions

Why does my certificate work in the browser but fail here?

The usual cause is a missing intermediate certificate. Browsers can sometimes fill the gap from cache or by fetching it, but a server should send the full chain (leaf plus intermediates).

What does "Hostname mismatch" mean?

The host you entered isn't listed in the certificate's Subject Alternative Names. Clients ignore the Common Name when SANs are present, so every host name must be in the SAN list.

Which TLS version should my server support?

TLS 1.2 and 1.3. TLS 1.0 and 1.1 are deprecated (RFC 8996) and rejected by current browsers.