# SSL Certificate Checker — Live Issuer, Expiry, SANs and Chain > Open a real TLS handshake to any host and read the certificate it is serving right now. To check an SSL certificate, enter a hostname and this tool opens a real TLS handshake to it, then reports what the server actually presented: subject, issuer, serial, validity dates with days remaining, every subject alternative name, key and signature algorithms, fingerprints and the full chain to the root. **URL:** https://convertto.tech/t/ssl-certificate-checker **Category:** Network Tools (https://convertto.tech/c/network-tools) **Privacy:** Uses a server request **Cost:** Free, no sign-up **Last updated:** 2026-09-11 ## Key facts - **Privacy:** Uses a server — the hostname you enter is sent so a TLS connection can be opened to it - **Method:** A real TLS handshake, not a certificate database lookup - **Trust verdict:** Validated against the public root store using SNI, the way a browser does - **Scope:** Public hostnames only — private, loopback and reserved addresses are refused - **Cost:** Free, unlimited, no sign-up ## What a live check tells you that a pasted certificate cannot A certificate file says what it says wherever you read it. What it cannot tell you is whether the server is actually serving it. Most TLS incidents are not bad certificates — they are the right certificate sitting on the wrong machine, a renewal that was issued but never deployed, a load balancer where one node still holds last year's file, or an intermediate the server forgot to send so half your clients fail and your browser does not. Opening a handshake is the only way to see any of that. If you already have the file and just want to read it, the [X.509 certificate decoder](https://convertto.tech/t/certificate-decoder) parses it in your browser without sending it anywhere. ## The fields that usually matter | Field | What it answers | What a problem looks like | | --- | --- | --- | | Valid to | How long you have | Under 14 days with no automated renewal behind it | | Subject alternative names | Which hostnames this certificate covers | The name you typed is missing — the common name does not count | | Issuer | Which CA signed it | An unexpected issuer, or a self-signed certificate in production | | Chain | What the server actually sent | One certificate only, when an intermediate is required | | Signature algorithm | How the CA signed it | SHA-1, which every modern client rejects | | Key | Algorithm and strength | RSA below 2048 bits | *Read in this order; expiry and SAN coverage account for most real failures.* ## Why the chain is shown separately A client trusts a root it already holds, so the server's job is to send everything between its own certificate and that root. Browsers paper over a missing intermediate by fetching it from the URL in the Authority Information Access extension, or by reusing one they cached earlier — which is why a site can look fine in your browser and fail in `curl`, on a phone, or from a server-side HTTP client. The chain table here lists exactly what the server sent, in order, so a gap is visible rather than inferred. ## Name matching, SNI and virtual hosts One address commonly serves many sites, so the client names the host it wants in the TLS handshake itself, via Server Name Indication, and the server picks a certificate from that. This tool sends the hostname you entered as the SNI name, so what comes back is the certificate that host gets — not whatever the IP answers with by default. Hostname matching is then done against the subject alternative names: **the common name has not been authoritative since RFC 2818 was superseded**, and a certificate whose CN matches but whose SAN list does not will be rejected by every current browser. > **Public hosts only** — This tool opens a socket from a shared server, so it refuses private, loopback, link-local and reserved addresses — including hostnames that resolve to them. To inspect something on your own network, run `openssl s_client -connect host:443 -servername host` locally and paste the result into the offline decoder. ## How to use 1. Enter a hostname, or paste an https:// URL. 2. Choose the port if the service is not on 443. 3. Press Run — the server opens a TLS handshake and reads the certificate off it. 4. Check the days remaining, then the SAN list and the chain below it. ## FAQ ### Why does my browser trust the certificate but this tool says it is untrusted? Usually a missing intermediate. Your browser has cached the intermediate from another site or fetched it from the Authority Information Access URL; a fresh client has neither. The chain table shows what the server actually sent, and if it is one certificate where it should be two, that is the fix. ### How many days before expiry should I renew? Automated renewal normally starts at a third of the certificate's remaining lifetime — around 30 days for a 90-day certificate. If the days-remaining figure here is in single digits, the renewal is not running rather than not yet due, and the failure is almost always in the challenge or the deploy step, not the CA. ### Why can I not check port 587 or 25? Those speak plain text first and upgrade with a STARTTLS command, so there is no certificate to read until a protocol conversation has happened. This tool only handles ports where TLS begins at connect. Use 465 for SMTP over implicit TLS. ### Does the wildcard in the SAN list cover my subdomain? Only one label deep. A wildcard for *.example.com matches api.example.com but not a.b.example.com, and it does not match bare example.com — which is why certificates normally list both the wildcard and the apex. Check the SAN table for the exact name your clients use. ### What does OCSP stapling tell me? That the server is attaching a fresh, CA-signed proof that the certificate has not been revoked, instead of leaving each client to ask the CA. It removes a round trip and a privacy leak on every new connection, and some clients require it when the certificate carries the must-staple extension. ### Is this the same as decoding a certificate I already have? No — the two answer different questions. This one reports what a host is serving at this moment, including the chain and the negotiated protocol. The X.509 certificate decoder parses a PEM or DER file you paste, entirely in your browser, and never sends it anywhere. Use that one when you already hold the file. ## Sources - [RFC 5280 — Internet X.509 Public Key Infrastructure Certificate and CRL Profile](https://www.rfc-editor.org/rfc/rfc5280) — IETF - [RFC 8446 — The Transport Layer Security (TLS) Protocol Version 1.3](https://www.rfc-editor.org/rfc/rfc8446) — IETF - [RFC 6125 — Identity Verification in TLS](https://www.rfc-editor.org/rfc/rfc6125) — IETF - [RFC 6962 — Certificate Transparency](https://www.rfc-editor.org/rfc/rfc6962) — IETF ## Related tools - [X.509 Certificate Decoder](https://convertto.tech/t/certificate-decoder): Decode a PEM certificate to see its subject, issuer, validity, SANs and key details. - [DNS Lookup](https://convertto.tech/t/dns-lookup): Pull every DNS record for a domain at once, check SPF and DMARC, and compare four public resolvers. - [HTTP Header Checker](https://convertto.tech/t/http-header-checker): Follow every redirect, grade the security headers and read the cookie and caching settings. - [What Is My IP Address](https://convertto.tech/t/what-is-my-ip): Your public IPv4 and IPv6 address with the routing, registry, blocklist and VPN-leak detail behind it. - [WHOIS / RDAP Domain Lookup](https://convertto.tech/t/whois-lookup): Registration dates, transfer locks and status codes in plain English, cross-checked against live DNS. - [Open Graph Preview](https://convertto.tech/t/open-graph-preview): Render your share card the way each platform really draws it, with the og:image measured. - [Bcrypt Hash Generator](https://convertto.tech/t/bcrypt-hash-generator): Hash a password with bcrypt at a configurable cost factor — the right way to store passwords. - [Connection & Network Information](https://convertto.tech/t/connection-info): See what your browser reports about the network: connection type, downlink estimate and round-trip time.