Tool · Security

SSL Certificate Checker

Opens a real TLS handshake to the host on port 443 with the hostname sent as SNI, then reports the certificate it was presented, how many days remain, and the protocol version and cipher suite that were negotiated.

Valid here does not mean valid for your users

The handshake deliberately does not abort on a verification failure, so you still get the details on a host whose chain is broken — the case you most need to look at. So the validity verdict is a separate fact from the certificate beside it, and it is a verdict against one trust store: the CA bundle this server ships with.

Your users do not use that store. A browser has its own, Windows has its own, a Java application has a cacerts file last updated during an upgrade, and an appliance may carry a bundle from years ago. A newer CA can validate here and fail on older clients; an internal PKI certificate always looks untrusted here and is trusted where it matters.
Revocation is not checked. No OCSP, no CRL — so a certificate revoked this morning still reports as valid with days remaining.
The hostname is not matched against the SANs. That comparison is yours to make from the SAN list. A certificate cryptographically impeccable for the wrong name is the most common TLS error users see.

You checked one endpoint, and the host is probably several

One node answered, not the service. The connection lands on whichever address DNS returned here, and behind a load balancer or an anycast CDN that is one node of many. The expired certificate on node three, the node still presenting the old chain, the regional edge your automation missed — none are visible from one clean check. That is why certificate monitoring belongs in a scheduled job over every endpoint, not in a page you visit when somebody complains.
The check is fixed to port 443. A management interface on 8443, LDAPS on 636 or SMTP STARTTLS on 587 is out of scope — and those are the certificates nobody watches, because they break quietly instead of taking a website down.
The hostname is sent as SNI. A server hosting many names returns a different certificate for each, so you see the one for that name and checking the wrong name tells you about the wrong service.

Negotiated is not allowed

TLS picks the best suite both ends support, so TLSv1.3 proves the server can do TLS 1.3 and says nothing about whether it will still negotiate TLS 1.0 with a client that asks. What the server accepts at its worst is the question a compliance review is asking, and answering it means handshakes with deliberately limited clients, which this tool does not attempt. Same for the cipher: one negotiated suite is not the accepted list.

Certificate fields

Subject / CNWho the certificate was issued to — ignored by browsers for hostname matching, which uses the SANs

SANSubject Alternative Names — the actual list of hostnames the certificate is valid for

IssuerThe CA that signed it; an issuer you do not recognise on your own host is worth a second look

Valid from / toThe validity window as the CA wrote it, in UTC

Days leftComputed against the clock on the server that ran the check

ProtocolThe TLS version actually negotiated for this connection, not the best the server supports

CipherThe suite actually negotiated, with its TLS version

FingerprintSHA-1 digest of the certificate — the form most pinning configurations and vendor UIs use

On days remaining: public certificate lifetimes have been shortening for years and still are, which changed what a renewal process has to be. A yearly calendar reminder worked at three years and does not now. If renewal is manual anywhere in your estate, that is the finding — not the days left on this one.

When to use something else

For an estate rather than a host, and on a schedule, ssl-cert-checker checks many hosts and ports and exits non-zero so cron or CI can act on it, and f5-cert-audit covers the certificates on a BIG-IP — the ones most often missed, because they are in nobody's web inventory.

For a judgement on the configuration rather than a reading of it, the tls-configuration-review prompt is the right tool, and crypto-policy-checker audits what devices are configured to permit instead of what one handshake chose. For where this is heading, pqc-migration-engineering and crypto-agility cover being able to change algorithms on schedule rather than in an emergency.