Initiate TLS handshake directly from the server, read certificate, negotiate protocol and remaining validity.
Check SSL/TLS certificates online. Enter a domain to view certificate validity, domain matching, days remaining, TLS version, cipher suites, and SAN list. Backend-initiated handshake with no CORS issues.
Certificate expiration, domain mismatches, and configuration errors are the most common issues for HTTPS websites. After expiration, browsers display an 'Not secure' warning causing visitor loss, and Google search rankings are also affected. Regular checking and early renewal are basic DevOps tasks to ensure HTTPS operates normally.
SSL Labs performs deep scoring (comprehensive testing including protocols, ciphers, vulnerabilities, taking about 2 minutes), while this tool performs quick basic checks (returning results in 1-3 seconds), covering core information like certificate validity, expiration, TLS version, cipher suites, and SAN list, suitable for quick pre-launch validation, renewal confirmation, and troubleshooting.
Possible reasons: 1) Website blocks overseas IPs (check servers are overseas); 2) Server has SNI differentiation but incomplete configuration; 3) Uses enterprise intranet self-signed certificate; 4) Firewall blocks check nodes. Check failure does not mean certificate has issues; judge based on specific error messages.
TLS 1.3 (2018, RFC 8446) is the latest version, with handshake speed improved from TLS 1.2's 2-RTT to 1-RTT or even 0-RTT, removing insecure algorithms like RSA key exchange, RC4, and SHA-1, enabling Forward Secrecy by default, with significant improvements in security and performance. New deployments should prioritize TLS 1.3 support while retaining TLS 1.2 for older client compatibility.
Recommend starting renewal preparation 30 days before expiration, completing deployment at least 7 days early. The tool uses color alerts: >30 days green (normal), 7-30 days yellow (should renew), <7 days red (urgent). Let's Encrypt certificates have 90-day validity; recommend configuring automatic renewal.
Let's EncryptSAN (Subject Alternative Name) is a list of domains/IPs declared allowed for use in the certificate. Modern browsers (Chrome 58+) no longer trust the Common Name (CN) field and only check SAN. If the accessed domain is not in the SAN list, browsers will report a 'name mismatch' error. One certificate can cover multiple domains via SAN (e.g., example.com, www.example.com, api.example.com).
Certificate fingerprints (SHA-1/SHA-256) are hash values of certificate content, usable for HPKP (deprecated), Certificate Pinning, and manual verification that deployed certificates match expectations—for example, confirming whether CDN has correctly loaded new certificates, or verifying certificate consistency across multiple servers. Note: SHA-1 fingerprints are for identification only and should not be used for security verification.
SSL/TLS certificate checking is the process of initiating a TLS handshake from the client to obtain and analyze certificate information returned by the target server, thereby determining whether HTTPS configuration is correct. Core check items include: whether the certificate is within its validity period, whether the accessed domain is in the certificate's allowed list (SAN matching), whether the certificate chain is complete and trusted, whether the TLS protocol version and cipher suites used are secure, etc.
**Why is certificate checking so important?** SSL certificates are the trust foundation of HTTPS. Once certificate issues occur (most commonly expiration), browsers directly block access, displaying a red warning page 'Your connection is not private', causing direct damage to website traffic, conversion rates, SEO rankings, and brand trust. According to monitoring, certificate expiration is the most common cause of HTTPS failures, accounting for over 40% of all HTTPS incidents.
**How is this different from accessing directly in a browser?** Browser access may have deviations due to cache, HSTS, enterprise proxies, client certificates, etc.; while certificate checker tools initiate standard TLS handshakes from independent nodes, returning objective, standardized certificate information suitable for DevOps verification scenarios. This tool initiates TLS handshakes directly from backend servers, **with no browser CORS restrictions**, and can check any publicly reachable HTTPS domain.
**Core information checked by this tool**: Certificate authorization status (valid or not), specific authorizationError error messages, TLS protocol version (TLS 1.2/1.3), negotiated cipher suite (Cipher), ALPN protocol negotiation results (h2/http/1.1), certificate issuer (Subject/Issuer), validity period start and end dates (validFrom/validTo), days remaining (with color alerts), SAN Subject Alternative Name list, SHA-1/SHA-256 fingerprints, response time, and complete JSON details.
Check results typically return in 1-3 seconds, suitable for scenarios like quick pre-launch validation, renewal confirmation, and troubleshooting. For deep scoring (such as SSL Labs A+-F rating including renegotiation, vulnerability testing, protocol support, etc.), recommend using together with SSL Labs Server Test.
| Protocol Version | Release Year | Current Status | Notes |
|---|---|---|---|
SSL 1.0-3.0 | 1995-1996 | ❌ Deprecated/Insecure | Contains critical vulnerabilities like POODLE; disabled by all modern browsers |
TLS 1.0 | 1999 | ❌ Deprecated | BEAST, CRIME vulnerabilities; prohibited since PCI DSS 2018 |
TLS 1.1 | 2006 | ❌ Deprecated | Formally deprecated in RFC 8996; Chrome/Firefox removed support in 2020 |
TLS 1.2 | 2008 | ⚠️ Widely Supported (Transition) | Currently most widely deployed with best compatibility, but has some weak cipher suite risks |
TLS 1.3 | 2018 (RFC 8446) | ✅ Recommended | Faster handshake (1-RTT/0-RTT), weak algorithms removed, preferred by modern browsers |
| Days Remaining | Status Color | Recommended Action |
|---|---|---|
| >30 days | 🟢 Green (Normal) | No action needed; check periodically |
| 7-30 days | 🟡 Yellow (Warning) | Start renewal process as soon as possible to ensure replacement before expiration |
| <7 days | 🔴 Red (Urgent) | Renew immediately; browsers will block access after expiration |
| 0 days/Expired | 🔴 Red (Expired) | Certificate is invalid; users will see security warnings and must be addressed immediately |
| Error Type | Common Causes | Solution Direction |
|---|---|---|
| Certificate expired | Certificate not renewed past validTo date | Renew and deploy new certificate promptly |
| Name mismatch | Current access domain not in certificate SAN list | Reissue certificate including target domain, or check CDN origin configuration |
| Incomplete chain | Server not configured with intermediate certificates correctly | Deploy intermediate certificate combined with leaf certificate |
| Self-signed certificate | Certificate issued by private CA, not publicly trusted | Use publicly trusted CA like Let's Encrypt to issue certificate |
| Untrusted issuer | CA root certificate not in browser trust store | Replace with certificate issued by trusted CA |
