SSL Certificate Checker

Real CT & X.509 Inspection

Check a website's SSL/TLS certificate, inspect its validity period, identify its issuer, and find out when it expires.

Domain Name or HTTPS URL No auto-navigation

Port (Optional)

Certificate Lookup Provider

Expiration Warning Threshold (Days)

Providers: SSLMate CertSpotter CT API, Sectigo crt.sh & Google DoH

Quick live tests:

Querying Certificate & DNS Providers... Resolving DNS via Google DoH and retrieving X.509 records from Certificate Transparency logs.

Certificate Status Summary

Queried Hostname — —

Certificate Status — —

Issuer — —

Valid From — —

Expiration Date — —

Days Remaining — —

Hostname Verification — Calculated locally (RFC 6125)

Chain Verification — —

Certificate Validity

Calculated from the X.509 validity timestamps and current system time

Valid-From Date —

Expiration Date —

Days Remaining —

Approximate Validity Period —

Current Validity State —

Warning Threshold 30 days

Issued Lifecycle elapsed Expires

Note: A valid timestamp window does not guarantee that a certificate has not been revoked or that the host server will remain operational until expiration.

Certificate Information

Subject, issuer, cryptographic algorithms, and X.509 identifiers

Subject Common Name (CN) —

Subject Organization (O) —

Issuer Common Name (CN) —

Issuer Organization (O) —

Serial Number —

Certificate Version —

Signature Algorithm —

Public-Key Algorithm —

Public-Key Size —

Valid-From Timestamp (ISO 8601) —

Valid-Until Timestamp (ISO 8601) —

Covered Domains

Subject Alternative Names (SANs) evaluated using RFC 6125 wildcard rules

Certificate Chain Information

Leaf certificate, issuing CA details, and browser-handshake scope note

Technical Details, Fingerprints & Diagnostics

Cryptographic digests and itemized verification checks

SHA-256 Certificate Fingerprint

—

SHA-1 Certificate Fingerprint

—

Public-Key SHA-256 Digest (SPKI / Provider Reported)

—

Diagnostic Check	Status	Verification Source	Details

Expiration Warnings & Verification Advisories

Actionable alerts regarding certificate lifecycle, hostname coverage, and trust

Copy & Export Certificate Results

Copy specific fields or export the verified lookup payload as structured JSON

Explore More Tools on TextTool.in

Fast, privacy-first browser utilities on TextTool.in

TextTool.in Directory Browse all formatting, encoding, developer, and web utilities on TextTool.in. URL & Text Utilities Inspect, clean, and transform URLs, domains, and structured text strings. JSON & Data Formatters Validate and format exported SSL JSON reports and developer payloads.

Frequently Asked Questions

Understanding SSL/TLS certificates, Certificate Transparency, and wildcard rules

How does this SSL Checker retrieve real certificate information in the browser?

Web browsers prohibit client-side JavaScript from opening raw TCP sockets to inspect a TLS handshake directly. To retrieve authentic data without faking results, this tool queries public Certificate Transparency (CT) APIs—specifically the documented SSLMate CertSpotter API and Sectigo crt.sh—alongside Google DNS-over-HTTPS (DoH). When CertSpotter returns the raw X.509 DER certificate binary, this page parses the ASN.1 structure locally in your browser and computes cryptographic SHA-256 and SHA-1 digests via the WebCrypto API.

Why do wildcard certificates like *.example.com not cover example.com or sub.a.example.com?

Under RFC 6125 Section 6.4.3, the wildcard character (*) in a Subject Alternative Name only matches a single leftmost DNS label. Consequently, *.example.com covers www.example.com or api.example.com, but it does not cover the bare apex domain example.com (which must be listed as a separate SAN entry) or multi-level subdomains such as shop.eu.example.com.

Does a valid SSL certificate prove that a website is safe and trustworthy?

No. An SSL/TLS certificate only confirms that a Certificate Authority issued a certificate for that domain name and that traffic can be encrypted. Phishing or malicious websites can also obtain valid Domain Validated (DV) certificates. Always verify the domain spelling and organization independently.

Why are custom ports (other than 443) or full server intermediate chains marked as limited in browser-only checks?

Certificate Transparency logs record publicly trusted certificates issued for a hostname regardless of which TCP port the server uses, and they do not test whether a web server on a custom port is currently sending all required intermediate CA certificates during a live TLS handshake. Full port-specific handshake diagnostics require a server-side raw TLS socket backend.