TLS Certificate Check
We open a TLS connection to port 443 of the host and report what it presents. Only public addresses are contacted.
When you open an HTTPS site, the server presents a certificate that proves it may use that name, signed by a certificate authority your device trusts. This tool opens a TLS connection to port 443 of the host and reports what it presents: the names the certificate covers, who issued it, when it expires, the chain up to the authority, and the protocol version and cipher that were negotiated.
The handshake is completed even when the certificate doesn’t validate, so you can see why a browser would warn. The host is resolved first and only public addresses are contacted; nothing is sent after the handshake.
Frequently asked questions
Why does the certificate not cover my domain?
The certificate's subject alternative names (SAN) must include the exact name, or a wildcard such as *.example.com that matches one label. A certificate for example.com does not cover www.example.com unless both are listed.
How early should I renew?
Automated certificates (for example from Let's Encrypt) renew about 30 days before expiry. If yours has less than two weeks left, check the renewal job.
What does 'not trusted' mean?
The chain doesn't lead to an authority in our trust store: the certificate may be self-signed, expired, or the server may be missing an intermediate certificate.