Help / SSL certificate check
SSL certificate check
Checks a site’s TLS certificate: whether it’s trusted, how many days are left, which names it covers, who issued it, and the chain.
How to use it
- Type a hostname, optionally with a port (mail.example.com:993).
- Press Check.
Reading the results
- Trusted
- A normal HTTPS connection succeeded: valid dates, right name, complete chain.
- Names covered
- The hostnames the certificate is valid for (SANs). *.example.com covers one level of subdomain.
- Chain
- The certificate plus the intermediate certificates the server sends.
- Self-signed
- Issued by itself, not a public authority. Browsers won’t trust it.
- From CT logs
- Details came from public Certificate Transparency logs instead of the live server.
Examples
- github.com A healthy certificate
- expired.badssl.com An expired one
- wrong.host.badssl.com Wrong name
From the command line
curl "https://tools.nexayori.com/ssl?q=github.com" curl "https://tools.nexayori.com/ssl?q=github.com&format=json"
| q | Hostname[:port] |
| format | text, json or html |
Questions
Why does my site show “From CT logs”?
Sites behind Cloudflare can’t be connected to directly from Cloudflare’s own network, so the newest logged certificate is shown instead.
How early should I renew?
Most certificates auto-renew about 30 days before expiry. Under 14 days left is flagged.
Limitations
- Certificate details need the server to accept TLS 1.2; TLS 1.3-only servers fall back to CT logs.
- Trust is only checked on standard HTTPS ports.