Security Diagnostic Tool Free Tier · 30 req/min

Free SSL Certificate Checker

Inspect TLS/SSL certificate chains, expiration countdowns, Subject Alternative Names (SAN), issuing Certificate Authorities (CA), and TLS protocol cipher strength on port 443.

Sample queries: example.com · google.com · cloudflare.com

Notice

Could not establish a TLS/SSL connection to port 443 on example.io.

Suggestions:

Verify that the web server is listening on TCP port 443 and that HTTPS is enabled
Ensure network firewalls or security groups permit inbound HTTPS traffic from public resolvers
The TLS handshake may have timed out (>5s) or failed due to an incompatible cipher suite or untrusted certificate

TLS Protocol Versions

Modern web encryption relies on TLS 1.2 and TLS 1.3 (RFC 8446). Legacy protocols (SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1) contain fundamental cryptographic vulnerabilities (such as POODLE and BEAST) and are deprecated across modern browsers.

Subject Alternative Names (SANs)

Subject Alternative Name (SAN) extension in X.509 certificates allows a single TLS certificate to secure multiple fully qualified domain names (FQDNs), including wildcard configurations (e.g., *.example.com). Modern browsers require valid SAN entries.

Automated Renewal Cycles

Industry standards led by the CA/Browser Forum require 90-day maximum certificate lifespans for automated CAs like Let's Encrypt, with proposals moving toward 45 days. ACME protocol clients handle renewal automatically to prevent unexpected site outages.

Frequently Asked Questions

What does this SSL certificate check verify?

The SSL checker connects directly to TCP port 443 of the target server to complete a TLS handshake. It parses the X.509 certificate to check validity date boundaries, days remaining until expiry, issuing Certificate Authority (CA), Subject Alternative Names (SANs), and cryptographic parameters.

What are Subject Alternative Names (SANs) and why are they needed?

Subject Alternative Names (SANs) allow a single SSL/TLS certificate to secure multiple distinct hostnames and subdomains (for example, securing both example.com and www.example.com under one certificate). Modern browsers require valid SAN entries for TLS verification.

Why would an SSL check fail or return a connection error?

Handshake failures typically happen when the target server has no HTTPS service listening on port 443, port 443 is blocked by a network firewall, the connection times out (>5 seconds), the certificate is expired, or the certificate was self-signed and untrusted by standard trust stores.

How early should an SSL certificate be renewed before expiration?

Industry best practice is to renew certificates at least 30 days prior to expiration. Modern automated ACME clients (such as Certbot) typically attempt renewal at 30 days remaining for 90-day certificates to provide ample buffer for DNS or validation troubleshooting.

Is the SSL certificate checker free to use?

Yes. Single interactive SSL checks are completely free without requiring an account, subject to a fair-usage rate limit of 30 requests per minute per IP address.