TLS Certificate Inspector

Know whether a domain’s certificate chain is current, trusted, and correctly matched.

Inspect a public HTTPS certificate and understand its identity, validity, issuer chain, Subject Alternative Name (SAN) coverage, negotiated TLS parameters, and remediation-oriented findings. “SSL” is treated as a legacy name; this page reports TLS behavior.

TLS analysis tool
Illustrative sample reports — not live domains: A · strongB · warningC · moderateD · seriousF · failing

Grade guide: A means no major finding in the observed data; B means a warning needs attention; C means a significant finding is present; D means multiple serious findings need remediation; F means the example is failing on fundamental checks. The grade is a compact screening aid, not a compliance certification.

Upload a PEM or DER certificate to inspect its actual fields locally.Sample report — no scan run

Privacy: certificate parsing happens in this browser; the selected file is not uploaded by this page. Remote handshake, chain-path validation, OCSP, and CT checks require a backend scanner and are not inferred from a hostname alone.

Validity window

Issued Jun 20, 2026 · expires Sep 18, 2026
Renewal recommended in 41 days.

Handshake snapshot

Negotiated TLS versionTLS 1.3
Negotiated cipher suiteTLS_AES_256_GCM_SHA384
Stapled OCSP responsePresent

Suggested next action

No immediate action. Keep normal renewal automation and monitor CT logs for unexpected issuances.

Export options

Planned: JSON report, compliance PDF, Jira ticket draft, Slack/Telegram alert, and cert inventory CSV.

Subject Alternative Names


Name coverage check

Requested hostname is covered by the leaf certificate SAN list.

Protocol support

Negotiated handshake

TLS version
Cipher suite
Name format

Complete supported cipher suites found

Post-Quantum Readiness

This is an externally observable endpoint assessment. It does not certify an organization’s complete cryptographic inventory or guarantee future quantum safety.

Endpoint certificate

Assessment—
Evidence—
Certificate signature—
Certificate public key—

TLS key exchange

Assessment—
Evidence—

Suggested migration steps


    What this scan cannot determine

      X.509 identity and validity fields

      Subject
      Issuer
      Serial number
      Not Before
      Not After

      Key, signature, and important extensions

      Subject Public Key Info
      Signature algorithm
      Key Usage
      Extended Key Usage
      Basic Constraints

      Additional fields to include in full scanner output

      Version, Subject Key Identifier (SKI), Authority Key Identifier (AKI), Certificate Policies, Authority Information Access (AIA), CRL Distribution Points, Signed Certificate Timestamps (SCTs), fingerprints, PEM/DER encoding, and full path-validation result.

      Terminology and behavior references

      • RFC 5280: X.509 certificate profile, certificate fields, extensions, and path validation.
      • RFC 5246: TLS 1.2 protocol and TLS 1.2 cipher suite structure.
      • RFC 8446: TLS 1.3 protocol; cipher suites no longer encode key exchange or certificate authentication.
      • IANA TLS Cipher Suites registry: standard cipher suite names and recommended/discouraged status.
      • OpenSSL s_client, ciphers, and x509 manuals: scanner commands and OpenSSL naming behavior.
      • CA/Browser Forum TLS Baseline Requirements and Mozilla Root Store Policy: public TLS certificate issuance/trust expectations.
      
        
      
      
      
    
      
    
      
      
      What this certificate checker can tell you
      
      
      Certificate Inspector helps developers, IT teams, and site owners review the public TLS configuration presented by an HTTPS service. A scan can report certificate identity, expiration, hostname coverage, issuer information, negotiated TLS details, and findings that may require remediation.
      
      
      The result is an external snapshot of the tested endpoint. It is not a complete audit of internal certificates, private-key protection, VPNs, HSMs, code-signing systems, stored data, or organizational compliance.
      
      
      
        
      How to use the result
      A clean result means no major issue was found in the fields this scanner could observe. Warnings may point to renewal timing or policy-dependent configuration. A failing result means one or more serious findings should be investigated by the service owner.
      
        
      Continue learning
      Read the methodology, review the FAQ or post-quantum guide, or use the troubleshooting guides for expiration, hostname mismatches, and certificate chains.