IPconf
← Tools

SSL Check

Inspect SSL/TLS certificate details and expiry for any domain.

Connects to a host on port 443 and reads back its TLS certificate: subject hostnames (SAN), validity window, issuer, signature algorithm, and the intermediate chain. Runs from our server, so it bypasses your local trust store and shows what an outside client actually sees — the same view a fresh CI runner or a new mobile device would get.

Reading the result

  • Subject / SANs — the hostnames the certificate is valid for. Modern browsers ignore the legacy Common Name field and only honor Subject Alternative Names.
  • Wildcards — *.example.com covers exactly one label: it matches www.example.com but not the apex example.com itself, and not staging.api.example.com.
  • Not before / Not after — the validity window. Let's Encrypt is 90 days; commercial CAs commonly 397 days. Anything not auto-renewed is a time bomb.
  • Issuer — which CA signed the leaf certificate. A complete chain ends at a publicly trusted root.
  • Signature algorithm — expect SHA-256 or stronger. SHA-1 is deprecated and rejected by browsers.

Common use cases

  • Verifying a new certificate after installation — confirm SANs cover every hostname users actually open.
  • Debugging "Your connection is not private" — check expiry first, then chain completeness. Missing intermediates are the classic "works in Chrome, fails on iOS" cause.
  • Pre-renewal sanity check — confirm your renewal automation actually replaced the cert, not just rolled the timestamp.
  • Vendor / partner audits — see what cert a third-party API endpoint serves before integrating against it.

Gotchas

  • A valid certificate doesn't prevent the "not fully secure" indicator — that comes from mixed content (HTTP images / scripts / styles loaded into an HTTPS page).
  • "It works on my machine" often means your local trust store has a cached intermediate. Always verify from a clean environment.
  • Full troubleshooting checklist: SSL certificate troubleshooting checklist.