TLS Certificate Inspector · Local parser

Know whether a domain’s certificate chain is current, trusted, and correctly matched.

Interactive staging mockup for a certificate-inspection workflow: hostname lookup, certificate identity and validity, issuer chain, Subject Alternative Name (SAN) coverage, negotiated TLS parameters, supported cipher suites, and remediation-oriented findings. “SSL” is treated as a legacy name; this page reports TLS behavior.

Staging prototype
Demo examples (click to load local sample data): healthy.example.comexpiring-soon.example.combroken-chain.example.com
Upload a PEM or DER certificate to inspect its actual fields locally.Demo data

Privacy: certificate parsing happens in this browser; the selected file is not uploaded by this page. Remote handshake, chain-path validation, OCSP, and CT checks require a backend scanner and are not inferred from a hostname alone.

Validity window

Issued Jun 20, 2026 · expires Sep 18, 2026
Renewal recommended in 41 days.

Handshake snapshot

Negotiated TLS versionTLS 1.3
Negotiated cipher suiteTLS_AES_256_GCM_SHA384
Stapled OCSP responsePresent

Suggested next action

No immediate action. Keep normal renewal automation and monitor CT logs for unexpected issuances.

Export options

Planned: JSON report, compliance PDF, Jira ticket draft, Slack/Telegram alert, and cert inventory CSV.

Subject Alternative Names


Name coverage check

Requested hostname is covered by the leaf certificate SAN list.

Protocol support

Negotiated handshake

TLS version
Cipher suite
Name format

Complete supported cipher suites found

X.509 identity and validity fields

Subject
Issuer
Serial number
Not Before
Not After

Key, signature, and important extensions

Subject Public Key Info
Signature algorithm
Key Usage
Extended Key Usage
Basic Constraints

Additional fields to include in full scanner output

Version, Subject Key Identifier (SKI), Authority Key Identifier (AKI), Certificate Policies, Authority Information Access (AIA), CRL Distribution Points, Signed Certificate Timestamps (SCTs), fingerprints, PEM/DER encoding, and full path-validation result.

Terminology and behavior references

  • RFC 5280: X.509 certificate profile, certificate fields, extensions, and path validation.
  • RFC 5246: TLS 1.2 protocol and TLS 1.2 cipher suite structure.
  • RFC 8446: TLS 1.3 protocol; cipher suites no longer encode key exchange or certificate authentication.
  • IANA TLS Cipher Suites registry: standard cipher suite names and recommended/discouraged status.
  • OpenSSL s_client, ciphers, and x509 manuals: scanner commands and OpenSSL naming behavior.
  • CA/Browser Forum TLS Baseline Requirements and Mozilla Root Store Policy: public TLS certificate issuance/trust expectations.