SSL Certificate Checker

This tool connects to a host and reads its TLS certificate. It shows the subject, the issuer, the validity dates, the alternative names, the certificate chain, and the negotiated cipher.

The tool makes one TLS handshake and reports the negotiated cipher. It does not enumerate all ciphers that the server supports.

The tool shows three independent checks: the trust chain, the hostname match, and the validity dates. A certificate can have good dates and still fail, because the hostname does not match. Each check keeps its own status.

The chain shows the leaf certificate first, then each intermediate certificate, then the root certificate. The tool flags a missing intermediate certificate and a self-signed certificate. A browser can hide a missing intermediate certificate, but a command line client or a mobile app then fails.

Each certificate in the chain shows its public key type and size, its signature algorithm, its extended key usage, its OCSP responder URL, and its CRL distribution URL. Use the PEM actions to copy or to download one certificate.

To inspect an IPv6 address, put the address in brackets, such as [2001:db8::1]:443.