XunLMove cross-border work forward
English
中文EnglishEspañolDeutsch
My tools

SSL Certificate Checker

Enter a domain or URL and press Check. Our server connects to port 443 on the site and reads the certificate; results usually take 2–5 seconds.

Our server connects to the site to read the certificate

Inputs

Results

    An input link contains the values you entered. Share only information you want to disclose.

    Certificate chain and validity explained

    How the certificate chain builds trust

    ② Root CA① Intermediate CA0 · example.com
    The server should send its own certificate (0) and the intermediate (①); the client verifies them against a root (②) in its trust store. Without the intermediate, some browsers and API clients report the site as untrusted.

    Validity window and days left

    ▼notBeforenotAfter≤ 14 ddaysLeft
    A certificate is valid only between notBefore and notAfter. Fewer than 14 days left is flagged as a warning (orange); 90-day certificates such as Let’s Encrypt normally renew with about 30 days left.

    YOUR NEXT STEP

    Turn a website check into a monitoring routine

    Create a company account to manage sites and notifications. Pro supports 5 sites and 5-minute availability monitoring, with deep diagnostics available according to your plan and permissions.

    Create company accountExplore ProContact us

    New companies receive a 14-day Pro trial, with no card required. Trials exclude the paid monthly credit grant.

    Already have an account? Open your workspace →

    Formula and method

    1) Resolve the domain and refuse private or reserved addresses; 2) run a full TLS handshake against the system trust store and record trust, protocol and cipher; 3) read the chain the server sends and parse each X.509 certificate (subject, issuer, validity, SAN, key, signature, SHA-256 fingerprint); 4) probe TLS 1.3, 1.2, 1.1 and 1.0 one by one; 5) read HSTS from the HTTPS response and any stapled OCSP response. Days left = notAfter − now.

    Worked example

    Enter xunl.net to see the issuer, days left, a 2–3 level chain, the SAN list and TLS 1.3 / 1.2 support.

    Assumptions and limits

    • Only HTTPS on port 443 is checked; mail servers (SMTP/IMAP) and custom ports are not.
    • “Trusted” uses the server’s system root store; very old devices may disagree.
    • Behind a CDN you see the certificate served by the CDN edge.

    Frequently asked questions

    How do I check when an SSL certificate expires?

    Enter the domain and read “Expires” and “Days until expiry”; fewer than 14 days is flagged.

    The browser is fine, so why is the intermediate missing?

    Browsers may cache or fetch the intermediate themselves, but curl, Java and many mobile apps do not. Configure the server to send the full chain.

    Should TLS 1.0 and 1.1 be disabled?

    Yes. RFC 8996 formally deprecates TLS 1.0 and 1.1, and major browsers have dropped them.

    Can I check an internal host or an IP address?

    For safety, private, local and reserved addresses are refused. Public IPs work, though certificates are usually issued for names.

    References

    SSL Certificate Checker practical guide and common questions

    What does SSL Certificate Checker calculate?

    Enter a domain or URL and press Check. Our server connects to port 443 on the site and reads the certificate; results usually take 2–5 seconds. 1) Resolve the domain and refuse private or reserved addresses; 2) run a full TLS handshake against the system trust store and record trust, protocol and cipher; 3) read the chain the server sends and parse each X.509 certificate (subject, issuer, validity, SAN, key, signature, SHA-256 fingerprint); 4) probe TLS 1.3, 1.2, 1.1 and 1.0 one by one; 5) read HSTS from the HTTPS response and any stapled OCSP response. Days left = notAfter − now.

    When is this useful?

    Enter xunl.net to see the issuer, days left, a 2–3 level chain, the SAN list and TLS 1.3 / 1.2 support.

    How do I enter the inputs?

    Enter the inputs for SSL Certificate Checker: Domain or URL. Calculate, check the units and assumptions, then copy or download the results.

    How should I interpret the results?

    Only HTTPS on port 443 is checked; mail servers (SMTP/IMAP) and custom ports are not. “Trusted” uses the server’s system root store; very old devices may disagree. Behind a CDN you see the certificate served by the CDN edge.

    Where are my inputs processed?

    The domain is sent to the xunl.net server, which resolves it and connects to port 443 on the site; private, local and reserved addresses are refused. Results are cached in memory for 10 minutes and not stored in a database. To prevent abuse, each visitor can run 8 checks a minute and 120 a day.