generatepassword.eu

SSL Certificate Checker

Check a server's TLS certificate: whether it is trusted, matches the host name and how long until it expires.

Ports 443, 465, 993, 995 and 8443 are supported (default 443).

Try an example

Looks good

Checked

  • OK

    Valid for another 47 days

    Expires on 25 Dec 2026.

  • OK

    Certificate matches example.com

    The host name is listed in the certificate's Subject Alternative Names.

  • OK

    Chain is trusted

    The certificate chains to a root certificate in the standard trust store, using the intermediates the server sent.

47days left
TLSv1.3protocol
EC (prime256v1) 256key

Certificate

Hostexample.com:443 (172.66.147.243)
Subjectexample.com
Names (SAN)example.com, *.example.com
IssuerSSL Corporation Cloudflare TLS Issuing ECC CA 3
Valid from26 Sep 2026 22:49 UTC
Valid until25 Dec 2026 22:56 UTC
Signatureecdsa-with-SHA256
Serial01EEE6AABB521D5E14FC315FD9985690
SHA-256 fingerprint85ca6ab068e9bcce88b6c4aa3c47f7d17228134a457f870d3800e6223a0df07a
CipherTLS_AES_256_GCM_SHA384 (256 bits)

Chain sent by the server

  1. example.com issued by Cloudflare TLS Issuing ECC CA 3 · expires 25 Dec 2026
  2. Cloudflare TLS Issuing ECC CA 3 issued by SSL.com TLS Transit ECC CA R2 · expires 27 May 2035
  3. SSL.com TLS Transit ECC CA R2 issued by SSL.com TLS ECC Root CA 2022 · expires 17 Oct 2037
  4. SSL.com TLS ECC Root CA 2022 issued by AAA Certificate Services · expires 31 Dec 2028

Handshake 5 ms.

About this tool

The checker connects to the server, performs a TLS handshake with the host name you entered (SNI) and inspects the certificate chain the server sends. It then checks trust against the standard root store, the host name match, validity dates and the key.

How to read the results

  • Chain is trusted: the certificate links to a trusted root using the intermediates the server sent. A missing intermediate is the most common cause of "works in my browser but not in apps" problems.
  • Hostname match: the name must appear in the Subject Alternative Names. A wildcard *.example.com covers one level only (www.example.com, not a.b.example.com or example.com).
  • Expiry: publicly trusted certificates issued since 15 March 2026 last at most 200 days, falling to 100 days in 2027 and 47 days in 2029 (CA/Browser Forum ballot SC-081). Automate renewal.
  • Protocol and cipher: what was negotiated with our client. It shows the server supports at least that protocol; it is not a full protocol scan.

Limitations

  • Only the negotiated protocol is shown; the checker does not test every TLS version or cipher suite.
  • Revocation (OCSP/CRL) status is not checked.
  • STARTTLS on ports 25 and 587 is not supported; ports 465, 993 and 995 use implicit TLS and are.
  • Only public addresses can be checked; the host must resolve to a public IP.

Frequently asked questions

Why does my site work in the browser but the checker says the chain is not trusted?

Browsers often fill in a missing intermediate certificate from their cache or by downloading it. Other clients (apps, APIs, older devices) do not. Configure your server to send the full chain (the "fullchain" file with Let's Encrypt).

What key size should I use?

RSA 2048 bits or an ECDSA P-256 key. Both are widely supported; ECDSA is faster.

Does this check if my certificate was revoked?

No. Revocation checking is not included.

Can I check a mail server's certificate?

Yes, for implicit-TLS ports: enter host:465 (SMTP submission), host:993 (IMAP) or host:995 (POP3). Port 25 and 587 use STARTTLS, which this tool does not support.

How long are SSL certificates valid?

At most 200 days for certificates issued since 15 March 2026, falling to 47 days by 2029.

What is an intermediate certificate?

The link between your certificate and a trusted root; the server must send it.

Is the SSL check free?

Yes.