What a TLS certificate does
When your browser connects to a site over HTTPS, the padlock it shows rests on a TLS certificate: a small, digitally signed document that binds a public key to one or more domain names. The certificate lets your browser do two things at once — confirm that it is really talking to the owner of the domain, and agree on encryption keys so nobody in between can read or alter the traffic. This checker performs the same opening handshake your browser performs and shows you the document the server chose to present.
Reading the results: chain, issuer and subject
A certificate is rarely trusted on its own. It is signed by an intermediate certificate authority, which is in turn signed by a root authority built into browsers and operating systems; together they form the chain of trust. The issuer field names the authority that signed this certificate — organisations such as Let's Encrypt, DigiCert or Sectigo — while the subject field describes the certificate's owner, today usually little more than the primary domain name, since modern browsers rely on the name list described below rather than the older organisational fields. If a link in the chain is missing or wrong, browsers refuse the connection even when the leaf certificate itself is perfectly valid, which is why “certificate error” so often means a server misconfiguration rather than an expired certificate.
Expiry dates and subject alternative names
Certificates are deliberately short-lived. The not before and not after dates bound the window in which a certificate may be used, and the days left figure in the results is the number site owners actually watch, because an expired certificate turns every visit into a full-page browser warning. Public certificates now last at most about a year, and many are issued for ninety days, which makes automated renewal essential rather than optional.
The subject alternative name (SAN) list is the set of hostnames the certificate is valid for. A certificate covering example.com does not automatically cover shop.example.com, though a wildcard entry such as *.example.com covers one level of subdomains. When a site works at one address and warns at another, a SAN that is missing the name being visited is the first thing to check — compare the address in your browser with this list, character for character.
Protocol and cipher
Beneath the certificate, the handshake also negotiates a protocol version and a cipher suite. TLS 1.3 is the current standard and TLS 1.2 remains widely acceptable; anything older — SSL 3.0, TLS 1.0 or 1.1 — is considered obsolete and is rejected by modern browsers. The cipher suite names the algorithms agreed for key exchange and encryption. You do not need to memorise suites: a result showing TLS 1.2 or 1.3 with a modern suite is healthy, and this tool formats the value for you whether the server reports it as a list or an object.
Limitations you should know about
This checker sees one handshake, from our server, using the hostname you entered as the SNI (Server Name Indication) value. Servers that host many sites choose a certificate based on that name, so checking the bare domain and a subdomain can legitimately return different certificates. A server may also present a different — or a default, generic — certificate to connections without the name it expects, and large sites serve different certificates from different data centres. Most importantly, a successful check proves the certificate is valid and correctly installed at this moment; it says nothing about the site's content, honesty or overall security. TLS authenticates the connection, not the intentions of whoever runs the other end.
How to use this tool
Enter a hostname without https:// and leave the port at 443 unless the service runs TLS on a non-standard port, such as a mail or admin service. Press Check and review the days left and SAN list first — those two fields explain the great majority of real-world certificate problems.
Frequently asked questions
Why does the certificate name differ from the site I typed?
Usually because of SNI or a content-delivery network: the edge server answering our request presented the certificate configured for that name or a shared default. Try the exact hostname you visit in your browser, and remember CDNs may serve several valid certificates for one site.
How many days left is “too few”?
Treat anything under 30 days as a prompt to confirm that automatic renewal is actually working, and under 7 days as urgent. Most renewal failures are silent until the old certificate lapses.
Does a valid certificate mean a site is safe?
No. It means the connection is encrypted and the domain is controlled by whoever obtained the certificate — which includes phishing sites, most of which use valid free certificates. Check the domain name itself, not just the padlock.
Why did the check fail on a site that loads fine?
Possible causes include the server requiring a client certificate, blocking our server's network, supporting only unusual TLS settings, or an incomplete chain that your browser happens to repair from its cache while a fresh handshake cannot.
Related tools
- DNS Lookup — find the server a name points to
- Port Checker — test whether port 443 is reachable at all
- What Is My IP? — see the connection from your side
- Speed Test — separate TLS problems from slow connections