Enter a host name and we will open a TLS connection to it, read the certificate it presents, and tell you whether it is installed correctly, still in date, issued to the right names and served with a complete chain.

Working

What the report covers

  • Whether the certificate is actually being served, and on which port
  • Issuer, validity dates and how long you have left
  • Every name the certificate covers, and whether the one you asked about is among them
  • Whether the intermediate chain is complete - the single most common cause of "not secure" on mobile

Why a certificate can be installed and still fail

A certificate that works in your desktop browser can still fail elsewhere. The usual reason is an incomplete chain: your server sends the leaf certificate but not the intermediate that links it to a trusted root. Desktop browsers often paper over this by fetching the intermediate themselves; mobile browsers, older Android devices and command-line clients do not. This check reports the chain as your server actually sends it.

Names, not just domains

A certificate is valid only for the names listed inside it. www.example.com and example.com are two different names, and a wildcard covers one level of subdomain, not two. If the name in the address bar is not in the certificate, every visitor sees a warning no matter how correctly it is installed.

What happens to what you type

We connect to the host name you give us and read what it presents publicly. Nothing is stored. If you leave an email address we send you the report and nothing else.