SSL Certificate Checker
Check the TLS certificate a website presents on port 443. See when it expires, who issued it, which names it covers, whether the chain is trusted, and the TLS version and cipher in use.
INPUT
RESULT
Enter a host name and choose Check.
The host name is sent to the Deskbox server, which connects to it on port 443 to read its certificate.
How to check a certificate
Enter the host
Type a domain such as example.com or paste a URL. Only port 443, the standard HTTPS port, is checked.
Run the check
The Deskbox server connects to the site, completes a TLS handshake and reads the certificate. No web page is requested.
Read the badges
Valid, expires soon, expired, name mismatch or untrusted chain. The details below show the dates, names, issuer chain and key.
What the checker looks at
A certificate is accepted only when it is within its validity dates, lists the name you typed among its subject alternative names, and chains up to a trusted certificate authority with the intermediate certificates the server sends. Trust is checked against the Mozilla list of root certificate authorities that Node.js uses, the same list Firefox relies on.
Expiring certificates
Public certificates are short-lived and getting shorter, so most sites renew them automatically. The checker warns when fewer than 14 days are left, which usually means automatic renewal has stopped working.
Frequently asked questions
What is sent to a server?
The host name is sent to the Deskbox server. It looks up the address, refuses private and reserved networks, opens a TLS connection on port 443 and reads the certificate. No web page is requested, and the result isn't cached or stored.
Why is the chain untrusted when my browser shows the site without a warning?
Browsers sometimes fetch a missing intermediate certificate themselves or remember it from another site. Many apps, scripts and older devices don't, so a server that doesn't send its full chain fails for them. Installing the intermediate certificate on the server fixes it.
Can I check another port or a server on my local network?
No. Only port 443 on public addresses can be checked. Private, loopback and other reserved addresses are refused, so the checker can't be used to probe internal networks.