generatepassword.eu

SSL Certificate Checker

Check a server's TLS certificate: whether it is trusted, matches the host name and how long until it expires.

Ports 443, 465, 993, 995 and 8443 are supported (default 443).

Try an example

Looks good

Checked

  • OK

    Valid for another 33 days

    Expires on 27 Oct 2026.

  • OK

    Certificate matches example.com

    The host name is listed in the certificate's Subject Alternative Names.

  • OK

    Chain is trusted

    The certificate chains to a root certificate in the standard trust store, using the intermediates the server sent.

33days left
TLSv1.3protocol
EC (prime256v1) 256key

Certificate

Hostexample.com:443 (172.66.147.243)
Subjectexample.com
Names (SAN)example.com, *.example.com
IssuerSSL Corporation Cloudflare TLS Issuing ECC CA 3
Valid from29 Jul 2026 22:10 UTC
Valid until27 Oct 2026 22:17 UTC
Signatureecdsa-with-SHA256
Serial0624D0AB311558780B7D5213B9631831
SHA-256 fingerprint6153a96fd1a6ab7f4d438fc34932484299d0729d9140b3a126bb2f9c07b02200
CipherTLS_AES_256_GCM_SHA384 (256 bits)

Chain sent by the server

  1. example.com issued by Cloudflare TLS Issuing ECC CA 3 · expires 27 Oct 2026
  2. Cloudflare TLS Issuing ECC CA 3 issued by SSL.com TLS Transit ECC CA R2 · expires 27 May 2035
  3. SSL.com TLS Transit ECC CA R2 issued by SSL.com TLS ECC Root CA 2022 · expires 17 Oct 2037
  4. SSL.com TLS ECC Root CA 2022 issued by AAA Certificate Services · expires 31 Dec 2028

Handshake 6 ms.

About this tool

The checker connects to the server, performs a TLS handshake with the host name you entered (SNI) and inspects the certificate chain the server sends. It then checks trust against the standard root store, the host name match, validity dates and the key.

How to read the results

  • Chain is trusted: the certificate links to a trusted root using the intermediates the server sent. A missing intermediate is the most common cause of "works in my browser but not in apps" problems.
  • Hostname match: the name must appear in the Subject Alternative Names. A wildcard *.example.com covers one level only (www.example.com, not a.b.example.com or example.com).
  • Expiry: publicly trusted certificates issued since 15 March 2026 last at most 200 days, falling to 100 days in 2027 and 47 days in 2029 (CA/Browser Forum ballot SC-081). Automate renewal.
  • Protocol and cipher: what was negotiated with our client. It shows the server supports at least that protocol; it is not a full protocol scan.

Limitations

  • Only the negotiated protocol is shown; the checker does not test every TLS version or cipher suite.
  • Revocation (OCSP/CRL) status is not checked.
  • STARTTLS on ports 25 and 587 is not supported; ports 465, 993 and 995 use implicit TLS and are.
  • Only public addresses can be checked; the host must resolve to a public IP.

Frequently asked questions

Why does my site work in the browser but the checker says the chain is not trusted?

Browsers often fill in a missing intermediate certificate from their cache or by downloading it. Other clients (apps, APIs, older devices) do not. Configure your server to send the full chain (the "fullchain" file with Let's Encrypt).

What key size should I use?

RSA 2048 bits or an ECDSA P-256 key. Both are widely supported; ECDSA is faster.

Does this check if my certificate was revoked?

No. Revocation checking is not included.

Can I check a mail server's certificate?

Yes, for implicit-TLS ports: enter host:465 (SMTP submission), host:993 (IMAP) or host:995 (POP3). Port 25 and 587 use STARTTLS, which this tool does not support.

How long are SSL certificates valid?

At most 200 days for certificates issued since 15 March 2026, falling to 47 days by 2029.

What is an intermediate certificate?

The link between your certificate and a trusted root; the server must send it.

Is the SSL check free?

Yes.