SSL Certificate Checker

The SSL Certificate Checker inspects whether a website’s TLS certificate is valid, matched to the requested domain, properly chained, and not close to expiration. This matters because HTTPS is more than a browser lock icon: it affects encrypted transport, server identity, user trust, search visibility, payment flows, API integrations, and automated clients. Operations, deployment, security-review, and incident-triage work benefit from the dates, issuer information, subject names, certificate chain details, and protocol signals it exposes. Common findings include forgotten renewals, missing intermediate certificates, uncovered subdomains, certificates installed on the wrong environment, and domains that redirect to a host with different coverage.

SSL/TLS certificates follow the X.509 standard. Each certificate contains these key fields: Subject (the holder's domain or organization), Issuer (the issuing CA), Validity (Not Before / Not After dates), Subject Public Key Info (public key and algorithm), Signature Algorithm (such as SHA256-RSA or ECDSA-SHA256), and X509v3 extensions (of which the most important is the Subject Alternative Name extension). During the TLS handshake, the server sends its chain in order: leaf certificate -> intermediate certificate(s) -> root certificate (which is built into the browser and does not need to be sent). The client starts at the leaf, verifies at each level that the Issuer matches the parent's Subject, uses the parent's public key to verify the child's signature, checks the validity window, and ultimately traces back to a trusted root. Let's Encrypt issues certificates that are valid for only 90 days, designed to be used with automation such as certbot; commercial certificates usually last 1 to 3 years. SNI (Server Name Indication) allows a single IP to host multiple HTTPS sites: the client first sends the SNI extension during the handshake to tell the server the target hostname, and the server returns the matching certificate. OCSP (Online Certificate Status Protocol) allows real-time queries on whether a certificate has been revoked, avoiding the need to download bulky CRL lists.

• X.509 certificate fields: Subject (holder), Issuer, Validity, Public Key, Signature Algorithm, and the SAN extension
• Certificate chain validation: starts at the leaf, checks Issuer -> Subject match level by level, verifies the child's signature with the parent's public key, and ultimately traces back to a trusted root
• Let's Encrypt certificates default to a 90-day validity, paired with certbot and similar tools for automatic renewal; commercial certificates typically last 1 to 3 years
• SNI (Server Name Indication) lets a single IP host multiple HTTPS sites; the client declares the target hostname during the handshake and receives the matching certificate
• OCSP is used for real-time revocation checks, avoiding the download of bulky CRLs; major CAs also deploy OCSP Stapling
• Expired certificates, weak signature algorithms (SHA-1), and insufficient key length (RSA under 2048 bits) all trigger modern browser security warnings