SSL Checker

What we check

• Trust. Whether the certificate chains up to an authority that browsers trust.
• Name match. Whether the domain you entered is one of the names on the certificate.
• Expiry. Days left, with a warning from three weeks out.
• Chain. Whether the server sends the intermediate certificates browsers need.
• TLS versions. Which protocol versions the server accepts.

The most common problems

Missing intermediate certificate

Desktop browsers sometimes fill the gap themselves, so the site looks fine on your laptop but fails on some phones, in apps and in tools like curl. With Let's Encrypt on Nginx, use fullchain.pem, not cert.pem, for ssl_certificate.

Certificate does not cover the name

A certificate for example.com does not cover www.example.com unless both are listed. A wildcard like *.example.com covers one level of subdomain, but not example.com itself and not a.b.example.com.

Renewal stopped working

Let's Encrypt certificates last 90 days and are renewed automatically. When one expires anyway, the usual causes are a firewall blocking port 80, DNS pointing somewhere else, or a CDN in front of the site intercepting the validation request.

Checking from the command line

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Limitations

• We connect to one IP address. If the domain points to several servers, others may have a different certificate.
• We do not check revocation (OCSP or CRL) or Certificate Transparency logs.
• For mail servers, we test implicit TLS ports (465, 993, 995). Ports that use STARTTLS, such as 25 and 587, are not supported yet.