SSL/TLS Certificate Checker

Network Server-side ssl tls certificate https expiration chain security

This tool processes your data on the server: whatever you submit here is sent over the network to be processed, then the result is sent back to your browser.

What it does

Connects to a domain on port 443 (or a custom port) and inspects its TLS certificate the way a browser would during the HTTPS handshake. It reports whether the certificate is currently valid, when it expires, who issued it, and shows the full certificate chain up to the root.

This is useful for:

Catching expiring certificates before they cause an outage.
Verifying a renewal/reissue actually deployed correctly.
Checking the chain of trust (intermediate certificates) is complete.
Confirming which hostnames (SANs) a certificate actually covers.

Try it

How it works

Your browser sends the domain and port to /api/tools/ssl-certificate-checker.
The server (tools/ssl-certificate-checker/server.js) opens a real TLS socket to host:port using Node's built-in tls module, performing a genuine TLS handshake (SNI included, so it works correctly behind name-based virtual hosting / CDNs).
It reads the peer certificate (and its full chain via getPeerCertificate(true)), computes days remaining until expiry, and returns everything as JSON, which is rendered in the table above.

What's checked

Field	Meaning
Valid now	Current date is between "valid from" and "valid to"
Days remaining	Days until the certificate expires (negative = expired)
Subject (CN)	The primary hostname the certificate was issued for
Subject Alt Names	All hostnames/domains the certificate covers
Issuer	The Certificate Authority that signed the certificate
Valid from / to	The certificate's validity window
Chain length	Number of certificates presented (leaf + intermediates)
Hostname match	Whether the requested domain matches the certificate (CN/SAN)

Notes

A self-signed or otherwise untrusted certificate is still analyzed (we don't abort the handshake on trust errors) — the tool explicitly flags this via Trusted by system so you can tell the difference between "expired" and "not trusted".
The connection uses SNI, so it correctly reports the certificate for domains hosted behind reverse proxies, load balancers, or CDNs that serve different certificates per hostname.
Only the certificate is inspected — no page content is fetched, and no data other than the domain/port ever leaves your browser.
If the host doesn't respond on the given port, or isn't using TLS at all, a clear connection error is reported instead of a fake result.