← ALL TOOLS
// RECON & INTEL · SERVER

SSL/TLS Certificate Checker

Inspect the certificate chain, expiry, hostname match, supported TLS versions and weak ciphers of a server.

RECON · SERVER-SIDE · RATE LIMIT 30/MIN

Rate limited: 10 runs in a burst, 30 per minute. Results are never stored. Too long to share as a link.

HISTORY

Your last 5 runs appear here for 7 days, on this device only.

RESULT

Fill in the form and run the tool; the result appears here.

SSL/TLS Certificate Checker connects to a host on a TLS port (443 or another from the list) and tests TLS 1.0 to 1.3, returning an A to F grade, the certificate chain, the negotiated protocol and cipher, days until expiry, hostname match and any weak ciphers the server accepts.

How to read the result

The certificate chain lists each certificate from the leaf up with subject, issuer, validity dates, SANs, key type and size; the protocol row shows which TLS versions the server accepted at all, separate from the negotiated protocol and cipher it chose for a normal connection.

Trusted chain and Hostname match decide whether a browser would show a warning; either failing triggers one. The weak cipher line lists NULL, export-grade, RC4, DES or 3DES, anonymous and MD5-based suites the server still accepts (the probe stops after four).

The grade is F for a missing or expired certificate, a hostname mismatch or a weak cipher chosen by default. Otherwise it starts at A and is capped at B for TLS 1.0 or 1.1 or fewer than 14 days to expiry, at C for any weak cipher accepted, and at D for an untrusted chain.

Defender tips

  • Disable TLS 1.0 and 1.1 outright; both are formally deprecated and fail most compliance frameworks (PCI DSS among them) even where nothing else is wrong with the configuration.
  • Automate certificate renewal (ACME/Let's Encrypt or your CA's API) so expiry is never a manual calendar reminder someone misses.
  • Remove RC4, DES, 3DES, export and anonymous suites; modern clients never need them.

FAQ

Why does it say the certificate is not trusted?

Either the chain is self-signed, incomplete (missing an intermediate), issued by a CA our trust store does not recognise, or expired. Each certificate is marked when it is self-signed or expired.

What does a hostname mismatch mean?

The certificate's subject or SAN entries do not include the hostname you connected to. Browsers block the connection for this even when the certificate itself is otherwise valid and trusted.

How are the days to expiry calculated?

It is the leaf certificate's notAfter date minus now, in whole days; a low or negative number needs action now, since expiry breaks every client at once.

// RELATED FINDING Weak TLS configuration: impact, fix and references in the Findings Explorer