SSL Checker

The three checks

“SSL certificate” is the everyday name; the protocol has been TLS for many years, and the two words are used interchangeably here. Whatever it is called, a client decides whether to trust a server by asking three questions, and this tool asks the same three.

All three must pass. A failure in any one stops a well-behaved client before it sends a request, so there is no HTTP status code to read, only a connection error. The HTTP vs HTTPS guide explains what each check protects against.

The missing intermediate: works in a browser, fails in code

Certificate authorities do not sign your certificate with their root. They sign it with an intermediate certificate, which the root signed in turn. A client only holds the roots, so the server has to send the intermediate along with its own certificate; without it, the client has a certificate signed by something it has never seen.

Browsers hide the mistake. They cache intermediates from other sites and can download a missing one using a URL inside the certificate, so the padlock appears and everything looks healthy. Command-line tools, programming language runtimes and other servers do none of that. The result is the classic report: the site works for every person who opens it, and every API client, webhook sender and monitoring probe gets unable to verify the first certificate or unable to get local issuer certificate.

This checker connects the way code does, without a cache and without fetching anything extra. If the chain check fails with a note that the intermediate was not sent, the fix is on the server: install the full chain file your authority provided, which most name fullchain.pem, in place of the certificate on its own.

Reading the rest of the report

Names on the certificate

The list of subject alternative names is the complete set of host names the certificate is good for. A wildcard such as *.example.com covers exactly one level: api.example.com, but neither example.com itself nor v2.api.example.com. The older “common name” field is no longer consulted by modern clients, so a name must be in this list to count.

Expiry

Public certificates are short-lived by design and getting shorter, which makes automatic renewal the only workable arrangement. When a certificate is inside its last two weeks and has not been replaced, the automation has usually stopped: a cron job removed, a DNS record the challenge depends on changed, or a renewed certificate sitting on disk because the web server was never reloaded. This tool flags anything with 15 days or fewer remaining.

Protocol, cipher and ALPN

These describe the single connection that was made: the TLS version and cipher suite the server chose from what was offered, and the application protocol agreed through ALPN, where h2 means the server speaks HTTP/2. They show what the server prefers, not everything it supports. A server that negotiates TLS 1.3 here may still accept older versions from older clients, and this check does not probe for those.

The chain

Each certificate is listed with its subject, issuer, validity, key and SHA-256 fingerprint. The fingerprint identifies one exact certificate, which makes it the thing to compare when you need to know whether two servers, or a server before and after a deployment, are presenting the same one.

What this check does not cover

• It is one vantage point. The connection is made from this site's server. A host behind a CDN or a geographic load balancer can present a different certificate elsewhere, and a server on a private network cannot be reached at all.
• Trust is judged against one root list. The chain is verified against the certificate authorities bundled with the Node.js runtime on our server, which follows Mozilla's list. A very old device, or a corporate machine with extra roots installed, may decide differently.
• Revocation is not checked. A certificate that has been revoked but is otherwise valid is reported as valid.
• Only implicit TLS, on a fixed list of ports. Services that begin in plain text and upgrade with STARTTLS, such as SMTP on port 587, cannot be checked, and arbitrary ports are not accepted.
• It is not a configuration audit. Weak cipher support, protocol downgrade and header policy are outside its scope.

To repeat the check from your own machine, curl -v https://example.com/ prints the handshake and certificate details; the curl verbose example explains the output, and the curl SSL example covers the certificate options.

Certificate errors and what they mean

When the cause is on your side as the caller, resist the shortcut of switching verification off. It turns an error into silence and removes the protection along with it; the curl ignore-certificate page sets out the safer options. If the host name will not resolve in the first place, start with the DNS lookup.

Frequently asked questions

Related tools and reference