Free tool · TLS / SSL
TLS / SSL certificate checker
Inspect any public domain's TLS certificate, supported protocols, cipher suites, and HSTS posture in one shot. No signup, no email gate.
What this tool checks
We perform a live TLS handshake against the host on port 443 and inspect what the server actually returns - issuer, subject, SAN list, validity window, and the SHA-256 fingerprint of the leaf cert. Then we walk the certificate chain to verify it terminates at a publicly-trusted root, flagging any chain breaks.
On the protocol side we negotiate down through TLS 1.3, 1.2, 1.1, and 1.0 to surface what's enabled, then enumerate the cipher suites the server is willing to use. Outdated protocols (TLS 1.0/1.1) and weak ciphers cost you points; modern AEAD ciphers and TLS 1.3 are full credit.
We also probe HSTS - whether the response sends the Strict-Transport-Security header, the max-age value, and whether includeSubDomains and preload are set. HSTS is what makes "https only" actually stick after the first visit; missing it leaves customers vulnerable to SSL-strip attacks on subsequent visits.
How to read the results
Days to expiry is the field that bites you most often - any cert under 14 days is a posture incident waiting to happen, and most outages we see come from a forgotten cert on a non-production endpoint (8443, 3128, internal admin panels). Wiredepth Pro monitors expiry continuously across all your endpoints; this free tool is the one-shot version.
Chain status being "incomplete" means the server isn't sending all intermediate certs - browsers usually paper over this via AIA fetching, but some clients (curl without ca-bundle, IoT devices, older Java) will fail outright. Always serve the full chain.
HSTS preload: if you've submitted to the HSTS Preload list and the header doesn't include preload + includeSubDomains + max-age ≥ 31536000, the preload submission is invalid and you've wasted the submission. Common gotcha.