Free SSL Certificate Checker
Run a free SSL certificate check for a public hostname. See expiry, issuer, SAN coverage, fingerprint, chain depth, validation, and TLS health.
Run SSL certificate checkerDomain Trust Watch / Tools
Tools
Free SSL certificate tools for live checks, PEM files, CT logs, and renewal planning.
Run a public SSL certificate probe, decode a certificate file, parse OpenSSL output, troubleshoot an SSL error, search Certificate Transparency logs, plan renewal runway, or build a monitor-ready hostname inventory.
Checker preview
api.example.com
A one-time read separates connection, identity, chain, and expiry state before a monitor is created.
IssuerDigiCert TLS RSA SHA256 2020 CA1
Runway84 days remaining
Names8 SANs cover this hostname
No accountRun a public TLS probe before deciding whether a hostname needs monitoring.
Failure classesSeparate DNS, TCP, TLS handshake, hostname, trust-chain, active-window, and expiry problems.
Distinct workbenchesUse live probes, renewal planning, CT search, PEM decoding, error troubleshooting, OpenSSL parsing, or inventory building.
Checker result
A one-time SSL check before you create a monitor.
The checker result shows issuer, expiry, runway, SAN count, chain depth, fingerprint, and validation state for one public hostname.
Reachability
Confirm the public hostname resolves and accepts the selected port.
Handshake
Check whether TLS negotiation succeeds before certificate details are trusted.
Identity
Read issuer, subject, SANs, serial, fingerprint, and chain depth.
Decision
Decide whether the endpoint needs a one-off fix or scheduled ownership.
SSL certificate tools
Choose the right SSL certificate checker.
Use the full SSL certificate checker for a complete public TLS result, or pick a focused tool based on the evidence you have: public endpoint, certificate file, OpenSSL output, error text, CT log search, renewal deadline, or hostname inventory.
Live public probes
Use these when the hostname is public and the customer-facing endpoint should be checked directly.
Free SSL checkerFree SSL Certificate Checker
Run a free SSL certificate check for a public hostname. See expiry, issuer, SAN coverage, fingerprint, chain depth, validation, and TLS health.
TLS health scannerTLS Configuration ScannerScan a public hostname's TLS configuration for protocol, cipher, ALPN, OCSP stapling, SCTs, HSTS, CAA records, and certificate identity.
Chain checkerSSL Certificate Chain CheckerCheck the SSL certificate chain served by a hostname, including leaf and intermediate certificates, issuer, expiry, key details, and chain depth.
CAA checkerCAA Record CheckerCheck DNS CAA records for a hostname and compare issuance policy with the served certificate issuer. Review issue, issuewild, iodef, and inherited CAA source.
Renewal checkerLet's Encrypt Renewal CheckerVerify an ACME or Let's Encrypt renewal on the public endpoint by checking validity dates, issuer, SANs, serial, fingerprint, and trust state.
Planning and discovery
Use these when you need to plan renewal work, review public issuance, or prepare a monitoring import.
Renewal runwaySSL Renewal Runway Planner
Check a live SSL certificate expiry date, days remaining, renewal runway, alert windows, owner handoff notes, and public endpoint proof.
CT log searchCertificate Transparency SearchSearch public Certificate Transparency logs for a domain. Review logged certificates, issuers, names, wildcard coverage, serial numbers, and validity windows.
Inventory builderSSL Certificate Inventory BuilderBuild an SSL certificate inventory from hostname lists, assign owners and environments, set warning windows, and export monitor-ready CSV.
Pasted evidence workbenches
Use these when the evidence comes from a PEM file, terminal output, private endpoint, or support error.
PEM decoderCertificate Decoder / PEM Inspector
Decode a pasted SSL/TLS certificate or fullchain PEM in your browser. Inspect issuer, subject, SANs, validity, key details, and fingerprints.
Error troubleshooterSSL Error TroubleshooterPaste a browser, OpenSSL, curl, or runtime SSL certificate error and map it to the likely layer, owner, first checks, fix path, and ticket handoff.
OpenSSL workbenchOpenSSL Certificate WorkbenchGenerate SNI-aware OpenSSL commands and parse certificate output into issuer, SANs, expiry, serial, fingerprint, chain, and verification fields.
Monitoring path
Use a one-time check first, then monitor the hostnames that keep coming back.
Scheduled monitoring adds expiry warning windows, certificate history, and alert routing when manual checks are no longer enough.