SSL Certificate Checker

What the checker inspects

The tool performs a real TLS handshake on port 443 with SNI, exactly like a browser, and reads the certificate the server presents: subject and issuer, validity window with a day countdown, every hostname in the Subject Alternative Name list, the negotiated protocol and cipher, the signature algorithm, and the length of the chain the server sent. Verification runs first with the standard trust store, so “trusted” here means trusted by real browsers, not merely present.

The three failures that matter

Expired is binary: past the date, every visitor gets a warning page. Name mismatch means the certificate does not cover the hostname being visited; it usually appears after domain or CDN changes. Broken chain is the sneakiest: the site works in browsers that cached the intermediate certificate and fails everywhere else, which makes it look intermittent. The report distinguishes all three so you fix the right thing.

Certificates during migrations

Every site move risks a certificate gap: the new server answers before its certificate is issued, or the old wildcard does not cover the new subdomain. Our migration checklist issues and verifies the new certificate before DNS switches, so visitors never see the gap. If you are planning a move, this checker plus our DNS lookup covers the two failure points that cause almost all launch-day outages.