Every HTTPS site presents a certificate that proves its identity. Browsers validate it in four places at once: is the signing CA trusted, does the certificate cover the hostname you are visiting, has the certificate expired, and was a modern TLS protocol negotiated. This tool inspects all four from our servers and streams the results back.
What you get
- Subject / SANs — every hostname the certificate covers.
- Issuer — which CA signed it (Let's Encrypt, Digicert, Google Trust, etc.).
- Validity — issued and expiration dates, plus how many days are left. Warnings when under 30 days.
- Key and signature — algorithm and bit length (RSA 2048, ECDSA P-256, …).
- Protocol / cipher — the TLS version and cipher suite actually negotiated.
- Chain — every intermediate CA, in order.
- Trust verdict — whether the default system truststore validates the chain.
FAQ
Why is my cert "not trusted"? Three common causes: the chain is missing an intermediate (server misconfigured), the root CA isn't in the system truststore (self-signed or private CA), or the cert is already expired.
What's a SAN? Subject Alternative Name — the modern way to list all hostnames a cert covers. If your browser shows "not secure" despite a valid cert, the hostname is probably missing from the SAN list.
Is TLS 1.2 still safe? Yes. TLS 1.3 is preferred, but 1.2 with modern ciphers remains acceptable. TLS 1.0 and 1.1 should be disabled on any public server.