TLS/SSL Certificate Checker

This tool connects to a live host over TLS and reports the certificate it actually presents right now — the same handshake a browser performs when you open the site, but with the full certificate chain, trust status and validity window laid out for inspection instead of hidden behind a padlock icon.

How to use it

1. Enter a host — a domain (example.com) or IP address, no https:// prefix or path.
2. Optionally change the port; it defaults to 443, the standard HTTPS port.
3. Click Check certificate. The tool opens a TLS connection server-side (a browser has no API for inspecting a raw TLS handshake) and reads back the certificate the host presents.
4. Review the Summary for the quick verdict — protocol, cipher, trust status and validity — then the detailed tables below it: Subject, Issuer, Validity, Certificate Details, Subject Alternative Names and the full Certificate Chain.

What gets reported

• Summary — the negotiated TLS protocol version and cipher suite, whether the certificate chains to a trusted root, and a plain-language validity status.
• Warnings — flags anything worth a second look: an untrusted or self-signed certificate, an expired or soon-to-expire certificate, or a host that doesn't match any of the certificate's Subject Alternative Names.
• Subject / Issuer — the distinguished name fields (Common Name, Organization, Organizational Unit, Country, State/Province, Locality) of the certificate and whoever signed it.
• Validity — the Not Before / Not After dates and a status (valid, expiring soon, expired, or not yet valid).
• Certificate Details — serial number, SHA-256/SHA-1 fingerprints, public key size, and the total number of certificates in the chain.
• Subject Alternative Names — every DNS name, IP address and other identity the certificate covers.
• Certificate Chain — every certificate from the leaf up to the root the server sent during the handshake, each with its own subject, issuer and expiry.

How this differs from pasting a certificate

If you already have a PEM-encoded certificate file, SSL Certificate Decoder parses it entirely in your browser without any network request. This tool is for the opposite case: you don't have the certificate file, only a hostname, and you want to see what a live server is actually presenting — including its full trust chain, which a lone PEM file usually doesn't include.

Privacy

The host you check is sent to our server only to open the TLS connection and read back the certificate, and is not stored. Requests to localhost, private, or link-local network addresses are blocked. Certificates are public-by-design artifacts — presented in the clear to any client that connects — so checking one here reveals nothing a normal browser visit wouldn't already see.

Does "Trusted" mean the certificate is safe?

"Trusted: Yes" means the certificate chains to a root certificate authority trusted by our server's default trust store — the same check a browser performs before showing a padlock. It doesn't check for revocation (CRL/OCSP) or confirm the site's contents are safe; it only confirms the certificate itself is validly signed and not expired.