SSL Checker

About SSL Checker

Enter a hostname or URL and click Check certificate. We pin DNS to a public address, handshake on port 443 with SNI, and still read broken certificates (the handshake does not require a trusted chain to inspect the leaf). You get hostname match, days left, issuer, chain, protocol and cipher, HSTS, HTTP to HTTPS, and whether an OCSP staple was present.

If the name you typed has a www or apex pair in the SAN list, we handshake that host too and report if one side fails. If the pair is not in SANs, the report says so. Non-443 ports are not probed.

When to use it

Use it after you swap a certificate on a CDN or load balancer, or when the renewal mail and the live leaf disagree. That is also the check after you add www to a name that used to live only on the apex.

It is the handshake on 443, not a header dump. HTTP Header Checker lists HSTS text. This page says whether the leaf matches the host, how many days remain, and which TLS versions the stack still accepts.

How to use SSL Checker

1. 1Enter a hostname or URL. Localhost and private addresses are blocked.
2. 2Click Check certificate. We pin DNS, then handshake on 443 with SNI.
3. 3Read Error, Warning, and Pass. Each row has why it matters and how to fix it.
4. 4Fix and re-check. Nothing is stored after the response.

What the handshake covers

Protocols probed: SSLv3, TLS 1.0, 1.1, 1.2, and 1.3. Legacy protocols that this runtime cannot offer show as Unavailable. Weak-cipher probes use RC4, DES, 3DES, NULL, and export suites on TLS 1.0 to 1.2. RSA under 2048 bits and SHA-1 or MD5 signatures are flagged. Perfect forward secrecy is ECDHE, DHE, or TLS 1.3.

Expiry: under 7 days is critical, under 30 days is a warning. HSTS presence on the HTTPS response is a pass; short max-age is not failed here. HTTP to HTTPS is a HEAD then GET of http://host/. OCSP is staple presence only; we do not replay the CA. CT logs and ALPN are not checked.

How to read the results

Rows are Error, Warning, Notice, and Pass. Fix hostname mismatch and a lapsed leaf before a missing HSTS line. Under 7 days left is critical. Under 30 is a warning. A countdown above 30 can still pass on expiry.

On example.com, TLS 1.0 and TLS 1.1 still accepted is critical; missing HSTS and HTTP that does not redirect are warnings; hostname match, a chain to a trusted root, and TLS 1.3 can still pass. An IP address returns Enter a hostname, not an IP address. Days left above 30 can pass on expiry while those protocol rows stay critical.

Why this matters

The browser compares the name you typed to the SAN list. A leaf that covers the apex and not www fails one host even when the other loads. That is why a www/apex pair in the SANs gets a second handshake here.

Offering TLS 1.0 or 1.1 lets an old client finish a weak handshake even when TLS 1.3 is also on. HTTP that never redirects keeps the first request in clear text. Those two findings are independent of days-left on a still-valid leaf.

Limits and privacy

Public hostnames only; an IP address is rejected before the handshake. About 20 Check certificate runs per minute on your network. The leaf is the one this lookup saw with SNI. No account and no saved certificate after you leave.

Common mistakes

Checking only the apex when visitors type www. If both names are in the SANs, handshake both. If the pair is missing, the report says so instead of inventing a host.

Reading a days-left figure above 30 as an emergency. The warning band starts under 30. Under 7 is the critical band.

Expecting an SSL Labs letter. This page lists protocol and cipher findings; it does not compute A+ through F.