SSL certificate checker

What this reads

It opens a TLS connection to the host on port 443, reads the certificate the server presents, and reports the expiry date, the issuer, the length of the chain and every name the certificate covers.

It does not fetch a page, follow a redirect or send a request. The handshake is the whole check.

Expiry is the one that gets people

Certificates have got shorter and shorter — ninety days from Let's Encrypt, and the industry is moving towards forty-seven. That is fine when renewal is automatic and catastrophic when it silently stops being automatic, which is the normal way this fails:

• The cron job that renews it runs on a server that was rebuilt.
• The renewal needs a port 80 challenge and a firewall rule closed it.
• The certificate is renewed correctly and the service that uses it is never reloaded, so it keeps serving the old one from memory.
• It was issued by hand eighteen months ago by somebody who has since left.

Every one of those produces a working site right up until the morning it produces a browser interstitial that no visitor will click through.

Does it cover the hostname?

A certificate is valid for a list of names, and a name not on the list fails regardless of how healthy the certificate is. This catches:

• A wildcard *.example.com does not cover example.com itself. One label, and the bare domain is not it.
• Nor does it cover a.b.example.com — a wildcard is one level deep only.
• A new subdomain pointed at an existing server whose certificate nobody reissued.

This is why the checker reports the names separately from the expiry. A certificate can be months from expiring and still be the wrong one.

Chain length

Browsers need a path from the certificate to a root they already trust. A server that sends only its own certificate and omits the intermediate will work in Chrome — which caches intermediates it has seen — and fail in a payment terminal, a mobile app, a curl on a fresh container, and any client without that cache.

That is a nasty class of bug: it works everywhere you tested and fails for a subset of real users, and the report you get is "the site is down for me".

What this checker reads

A TLS handshake against the hostname, and nothing else. No account, and the domain you type is not stored.