Connect to a live server and inspect its TLS certificate: expiry, issuer, trust chain, and covered domains.
An expired, mismatched, or untrusted certificate breaks HTTPS for visitors and their browsers will show a hard warning. Enter a domain above to connect directly (over TLS, on the port you specify) and inspect the certificate it actually presents right now - not a cached or third-party record of it.
CAA records control which Certificate Authorities are even allowed to issue for your domain in the first place.
Read the SSL/PKI DNS WikiThis checker connects directly to a host on a given port and inspects the live TLS certificate it presents: the expiry window, issuer, signature algorithm, the full Subject Alternative Name (SAN) list, and whether the certificate chains to a trusted root. That last check matters separately from expiry, because a certificate can be within its validity dates and still fail trust if the chain is incomplete, self-signed, or issued by a CA the connecting client does not recognize.
A common source of confusion is testing a certificate through a proxy, VPN, or a network with TLS inspection enabled, which substitutes its own certificate for the real one. If a result looks unexpectedly untrusted or the issuer looks unfamiliar, confirm you are testing from a network path that reaches the real server directly.
If you need related checks, try SSL/PKI DNS check DNS lookup and CAA record check tool.
Expiry is purely about the validity dates on the certificate. Trust is about whether the certificate chains up to a root certificate authority that browsers and operating systems ship by default. A certificate can be valid and untrusted (self-signed, for example) or trusted and expired.
A certificate only secures the exact hostnames listed in its Subject Alternative Names. If your site is reachable at both example.com and www.example.com but only one is in the SAN list, visitors to the other will see a certificate mismatch warning.
Most automated certificate authorities (like Let's Encrypt) recommend renewing around 30 days before expiry, and many renewal tools trigger automatically in that window. Manually issued certificates need a reminder set well ahead of the date, since there is no automatic retry if renewal fails.
Browsers, operating systems, and this checker each maintain their own trust store of root certificate authorities. A certificate can be valid in one context and flagged in another if that trust store differs, though this is uncommon for certificates from major public CAs.
Yes, this tool accepts any port, which is useful for mail servers (port 25, 465, 587), custom application ports, or internal services that expose TLS somewhere other than the default 443.
No, this connects directly to the server and inspects the certificate over TLS. CAA and DNSSEC affect which certificate authorities are allowed to issue certificates and DNS trust, respectively, but this check works independently of both.