SSL checker
Reads the certificate a host presents, including whether it covers the name you typed — a certificate for *.example.com does not cover example.com itself, and that catches people out.
Frequently asked questions
Does this give my site a security grade like SSL Labs?
No. This reads and reports on the certificate itself — issuer, expiry, and which hostnames it covers — rather than scoring your overall TLS setup. For a full grade covering cipher suites and protocol versions, use a dedicated security scanner; this tool is built for a fast, direct answer about the certificate.
Why does it say my certificate doesn't cover my domain, even though HTTPS works fine?
Usually a wildcard mismatch. A certificate for *.example.com covers subdomains like www.example.com, but not the bare example.com unless it's listed separately. This tool checks that specifically because it's a common, easy-to-miss mistake.
Can I check an expired or broken certificate with this?
Yes, on purpose. Many checkers refuse to connect at all if a certificate is expired, self-signed, or otherwise invalid. This one connects anyway and shows you exactly what's wrong — diagnosing the problem is the point, not just a pass/fail.
What does "self-signed" mean, and is it a problem?
The certificate was not issued by a recognized certificate authority — the server vouched for itself. Browsers usually warn about these on public sites, though they are normal and fine for internal tools or local development.
What are SANs, and why do they matter?
SAN stands for Subject Alternative Name — the full list of hostnames a certificate is actually valid for. One certificate can cover several domains and subdomains this way; if yours isn't on the list, it won't be trusted for it even if the certificate is otherwise fine.