What this checker tests
This tool opens a TLS handshake to your server on port 443 and reads the certificate the server presents — the same information any browser sees. It does not exchange application data, does not test authentication, and closes the connection immediately after reading the certificate.
The checker reports:
- Grade — A (valid, expires in >30 days), B (14–30 days), C (<14 days), F (expired or hostname mismatch)
- Expiry countdown — exact days remaining until the certificate expires
- Subject / Issuer — Common Name and Certificate Authority
- Subject Alternative Names (SANs) — all hostnames the certificate is valid for
- Protocol and cipher — TLS version and cipher suite negotiated
- Hostname match — whether the hostname you entered matches a SAN or CN in the certificate
Common SSL/TLS problems
| Problem | What you see | Fix |
|---|---|---|
| Expired certificate | Grade F, negative days remaining | Renew the certificate immediately; automate renewal |
| Hostname mismatch | Grade F, hostnameMatch: false | Reissue the certificate with the correct SAN / wildcard |
| Certificate expiring soon | Grade B or C | Renew now; set up auto-renewal before it expires again |
| Weak cipher suite | Cipher name shows RC4, DES, 3DES | Update TLS config to disable deprecated ciphers; use Mozilla SSL Config Generator |
For the most common SSL problem — an incomplete certificate chain where the browser shows a warning but curl doesn't — see the guide: Why Is My SSL Certificate Not Trusted?
Trust and differentiators
No account needed. We cache the result for 5 minutes, then it's gone, and it's never tied to you. The check is a passive TLS handshake — no application data exchanged. Safe against production.
For the full TLS picture — create a free pentes.io account. 5 scans a month with testssl.sh analysis, triaged findings and a downloadable report.
See all free security tools or read the SSL certificate guide for detailed remediation steps.