SSL certificate checker

What this connects to and reads

This opens a real TLS handshake to the domain (port 443 by default) and reads back exactly what the server presents - the same handshake a browser performs, inspected rather than trusted. It never sends credentials and closes the connection immediately after reading the certificate.

What each field means

• Subject / Issuer - who the certificate is for, and which certificate authority (or intermediate) issued it.
• Subject Alternative Names (SANs) - every hostname the certificate is actually valid for; modern browsers check this list, not the Subject field, when deciding whether a certificate matches the site.
• Public key - the algorithm and key size (RSA-2048, ECDSA-256, and so on) - larger/modern keys are harder to break, at some cost to handshake speed.
• Signature algorithm - how the issuing CA signed the certificate. SHA-1 signatures are considered weak and have been phased out by browsers.

Why the chain is shown too

A browser does not trust a single certificate in isolation - it verifies a path from the leaf certificate up through one or more intermediates to a root it already trusts. A missing intermediate is one of the most common real-world SSL misconfigurations: the certificate itself is fine, but browsers that do not already have the intermediate cached cannot complete the chain and show a warning.

Related tools

See the focused expiry checker, the chain checker on its own, and TLS version checker for which protocols the server accepts.