The browser rejects this certificate — why can this tool still read it?

They do different jobs. A browser validates the whole chain, name match, and revocation, and refuses to connect if anything fails. This tool deliberately validates none of that and simply shows what the server presented, which is what lets you diagnose why the browser objects.

Plenty of days left, so why do users report an error?

Usually the certificate has not expired but does not cover the exact name being visited. Check the SAN list for www and every subdomain. The other common cause is a missing intermediate certificate, which leaves the browser unable to build a complete chain.

NETWORK TOOLS · QUERIED BY OUR SERVER

SSL Certificate Checker

Connect to a site, read its certificate, and show the subject, issuer, validity period, and days remaining.

This lookup is made by our server contacting the host, not by your browser.

About this tool

Enter a domain to see the certificate the server currently presents: subject, issuer, validity dates, days remaining, and every domain it covers through subject alternative names. SAN is where problems usually hide — whether a certificate applies to a name depends on the SAN list, not the common name, so confirm every name you actually serve, including www and each subdomain. Days remaining is what you plan renewals against: automated renewal normally starts around 30 days before expiry, so a value that stays below that means renewal is not running. Chain validation is off by design, because a checker that refused to display a broken certificate could not help you diagnose one; being able to read a certificate here does not mean it is valid.

How it works

Enter a domain name.
Review the validity period, days remaining, and covered names.
Confirm every name you serve appears in the SAN list.

Limits and notes

The server connects to port 443 on the target host. Chain validation is deliberately switched off so expired and misconfigured certificates can still be displayed — so this tool does not assert that a certificate is valid, only shows what is presented.

How your input is handled

The domain or URL you enter is sent to our server, where an isolated process contacts the host on your behalf. Nothing you submit is stored or written to an analytics event, no cookies or authorization headers are forwarded, and the target's JavaScript is never executed. The server may only reach publicly routable internet addresses; private ranges, loopback, and cloud metadata addresses are refused.

Frequently asked questions

The browser rejects this certificate — why can this tool still read it?: They do different jobs. A browser validates the whole chain, name match, and revocation, and refuses to connect if anything fails. This tool deliberately validates none of that and simply shows what the server presented, which is what lets you diagnose why the browser objects.
Plenty of days left, so why do users report an error?: Usually the certificate has not expired but does not cover the exact name being visited. Check the SAN list for www and every subdomain. The other common cause is a missing intermediate certificate, which leaves the browser unable to build a complete chain.

← All network tools