What does this SSL checker inspect?

The server resolves the supplied hostname, validates all returned addresses, and makes one TLS handshake to a validated address on port 443. It reports the presented certificate’s subject, issuer, alternative names, dates, serial number, SHA-256 fingerprint and negotiated protocol. It does not request the website’s HTTP content.

Why are certificate-chain and hostname checks separate?

A certificate chain may be trusted by the Node.js runtime while the certificate does not match the hostname you entered. Conversely, a self-signed certificate can name the requested hostname while its chain is untrusted. The report preserves both results and their verification codes.

Can I inspect an expired or self-signed certificate?

Yes, when the server completes enough of the handshake to receive certificate metadata. Verification failure remains visible alongside the observed certificate. If no usable certificate is received, the checker reports a TLS error without inventing an empty successful result.

How current is the certificate result?

The displayed time is when our server observed the certificate. Each normalized hostname may use a cached observation for up to five minutes. Remaining days are calculated at that observation time. Different deployment regions or addresses may receive different certificates from the same hostname.

Can I check an IP address, private host or a different port?

This checker accepts one public DNS hostname and uses port 443 only. URLs, paths, credentials and IP literals are refused. If any resolved A or AAAA address is private, special-use or unsupported, no connection is made. International hostnames are normalized to their ASCII DNS form.

Does a verified certificate mean a website is safe?

No. These are standard chain and hostname checks for one observed handshake. They do not assess website content or vulnerabilities, sweep supported ciphers, check every server behind a hostname, or guarantee certificate revocation status.

Where is the hostname sent and can I keep the report?

The hostname goes to our server, its DNS resolver and the requested host during the handshake. The tool does not save your query in browser storage or send hostnames and certificate values to product analytics. You can copy the visible report or download it as a UTF-8 text file.

Why did a lookup time out or ask me to wait?

DNS resolution and the TLS handshake share an eight-second server deadline. Each server instance permits four concurrent lookups, and a platform rule limits these public lookup APIs to 20 requests per minute per IP address. A busy or rate-limited request asks you to wait and retry; it is not a certificate verification result.

SSL Checker

Observe the certificate a public hostname presents on port 443. Read its issuer, subject, alternative names, validity dates and negotiated TLS protocol, then review chain trust and hostname matching as separate checks. Every result includes its observation time and server vantage.

One hostname. One observed certificate.TLS · TCP 443 · current observation

Enter a DNS name without a URL, port or path. International names are converted to their ASCII DNS form. Private and special-use addresses are refused before connection.

Your hostname is sent to our server, its DNS resolver and the requested host for a TLS handshake. The lookup does not request a web page. Tool input and certificate values are excluded from product analytics.

CERTIFICATE WORKSHEETSee the presented identity, validity and verification results.Chain verification and hostname matching stay separate. Expired or self-signed certificates can still be inspected when the handshake provides metadata.

Enter a public hostname to inspect the certificate it presents on port 443.

Protocol: Not observed

Validity: Not observed

Days remaining: Not available

Port: 443

Accuracy. Point-in-time TLS metadata from one server/vantage. A valid certificate does not establish that a site is safe or free of vulnerabilities.

Source: public TLS handshake using the Node.js TLS runtime and DNS resolver. This observes one validated address from one deployment region. It does not sweep ciphers, check every server, guarantee revocation status or assess website safety.

Common questions

What does this SSL checker inspect?: The server resolves the supplied hostname, validates all returned addresses, and makes one TLS handshake to a validated address on port 443. It reports the presented certificate’s subject, issuer, alternative names, dates, serial number, SHA-256 fingerprint and negotiated protocol. It does not request the website’s HTTP content.
Why are certificate-chain and hostname checks separate?: A certificate chain may be trusted by the Node.js runtime while the certificate does not match the hostname you entered. Conversely, a self-signed certificate can name the requested hostname while its chain is untrusted. The report preserves both results and their verification codes.
Can I inspect an expired or self-signed certificate?: Yes, when the server completes enough of the handshake to receive certificate metadata. Verification failure remains visible alongside the observed certificate. If no usable certificate is received, the checker reports a TLS error without inventing an empty successful result.
How current is the certificate result?: The displayed time is when our server observed the certificate. Each normalized hostname may use a cached observation for up to five minutes. Remaining days are calculated at that observation time. Different deployment regions or addresses may receive different certificates from the same hostname.
Can I check an IP address, private host or a different port?: This checker accepts one public DNS hostname and uses port 443 only. URLs, paths, credentials and IP literals are refused. If any resolved A or AAAA address is private, special-use or unsupported, no connection is made. International hostnames are normalized to their ASCII DNS form.
Does a verified certificate mean a website is safe?: No. These are standard chain and hostname checks for one observed handshake. They do not assess website content or vulnerabilities, sweep supported ciphers, check every server behind a hostname, or guarantee certificate revocation status.
Where is the hostname sent and can I keep the report?: The hostname goes to our server, its DNS resolver and the requested host during the handshake. The tool does not save your query in browser storage or send hostnames and certificate values to product analytics. You can copy the visible report or download it as a UTF-8 text file.
Why did a lookup time out or ask me to wait?: DNS resolution and the TLS handshake share an eight-second server deadline. Each server instance permits four concurrent lookups, and a platform rule limits these public lookup APIs to 20 requests per minute per IP address. A busy or rate-limited request asks you to wait and retry; it is not a certificate verification result.

Point-in-time TLS metadata from one server/vantage. A valid certificate does not establish that a site is safe or free of vulnerabilities.