All free tools Tested live from VPSLake

SSL Checker

Connect to a site or server the way a browser does and see whether its certificate is trusted, covers the right name, sends the full chain and is close to expiry, plus the TLS version and cipher it negotiates.

TLS CERTIFICATE

Check a certificate

Live test
Port 443 is used unless you add one. Allowed ports: 443, 8443, control panels (2083, 2087, 2096, 2222, 8083, 8090, 10000), mail (465, 993, 995), 636, 853, 5986 and 6443.

The test runs on the VPSLake server. It opens one TLS connection to the public address the name resolves to and reads the certificate. Nothing is saved, and private or internal addresses are refused.

HOW TO USE IT

Test HTTPS in four steps

Run it after installing a certificate on a new server, after a renewal, or whenever a browser shows a security warning.

  1. 1

    Enter the host name

    Type the exact name visitors use, such as www.example.com. Add a port for other services, for example mail.example.com:993 or panel.example.com:8443.

  2. 2

    Run the check

    Select Check SSL Certificate. The server resolves the name, refuses private addresses, and opens a TLS connection with the name sent as SNI.

  3. 3

    Read the verdict

    See whether the certificate is trusted, covers the name, and how many days it has left, plus the chain, TLS version, cipher and key.

  4. 4

    Apply the suggested fix

    Problems come with the usual fix for a Linux server running certbot with Nginx or Apache. Reload the web server and check again.

What the checker tests

  • The certificate is inside its validity dates and how many days remain.
  • The name you typed is listed in the certificate, including wildcard rules.
  • The chain builds to a root in the standard public trust store.
  • The TLS version, cipher, key size and signature algorithm are still accepted by browsers.

Let's Encrypt on a VPS

On Ubuntu or Debian, sudo apt install certbot python3-certbot-nginx and then sudo certbot --nginx -d example.com -d www.example.com issues a free certificate and edits the Nginx config for you. Use python3-certbot-apache and --apache for Apache.

Certbot installs a timer that renews certificates about 30 days before expiry. Test it with sudo certbot renew --dry-run; if this checker ever shows fewer than 14 days left, renewal is failing.

Why the chain matters

Browsers trust a handful of root authorities. Your certificate is signed by an intermediate, and the server has to send that intermediate too. Desktop browsers sometimes fetch a missing one on their own, but phones, scripts and API clients fail with "unable to verify".

With certbot, point the web server at fullchain.pem, not cert.pem. For a purchased certificate, append the CA bundle below your certificate in the same file.

Behind Cloudflare or a CDN

When a site is proxied through Cloudflare, this checker sees the edge certificate Cloudflare serves, not the one on your VPS. To test the origin, check a hostname that is not proxied, or the server's IP address if its certificate lists the IP.

For Cloudflare's Full (strict) mode the origin still needs a valid certificate: a Let's Encrypt certificate or a Cloudflare Origin CA certificate both work.

Limits of a single connection

The checker makes one TLS connection to the first public address of the name and reports what that server sends. It does not test every IP of a load-balanced site, every protocol version a server accepts, or revocation status. It only connects to public addresses on a short list of TLS ports, so it cannot be used to probe private networks or scan ports.

FREQUENTLY ASKED QUESTIONS

SSL Checker FAQ

Desktop browsers often cache or download a missing intermediate certificate, which hides the problem. Many phones, payment gateways, webhooks and command-line tools do not. If the chain table lists only one certificate, the server is not sending the intermediate: configure it with the full chain file and reload the web server.
The name you entered is not in the certificate's list of names. A common case is a certificate for example.com only, while visitors use www.example.com. Issue a certificate for both names, for example certbot --nginx -d example.com -d www.example.com. A wildcard *.example.com covers one level of subdomain but not the bare domain itself.
Yes, for ports that start with TLS straight away: 465 (SMTPS), 993 (IMAPS), 995 (POP3S), 8443, common panel ports such as 2083, 2087, 2096, 2222, 8083, 8090 and 10000, plus 636, 853, 5986 and 6443. Ports that upgrade with STARTTLS, such as 25, 587 and 143, are not supported, and other ports are refused so the tool cannot be used as a port scanner.
Usually one of three things: port 80 is closed in the firewall so the HTTP challenge fails, the domain's A or AAAA record no longer points at this server, or the certificate renewed but the web server was never reloaded. Run sudo certbot renew --dry-run to see the error, and add --deploy-hook "systemctl reload nginx" so the new certificate is picked up.
TLS 1.2 and TLS 1.3. Browsers no longer accept TLS 1.0 or 1.1. In Nginx that is ssl_protocols TLSv1.2 TLSv1.3; and in Apache SSLProtocol -all +TLSv1.2 +TLSv1.3. The checker reports the version the server chose for this connection, which is normally the newest both sides support.
This is a public checker. The name is resolved first, and if any address is loopback, private, link-local, carrier-grade NAT or otherwise reserved, the check is refused. That keeps the tool from being pointed at internal systems. To test a server on a private network, run openssl s_client -connect host:443 -servername host from inside that network.
The tool does not save what you check. Each visitor can run a few checks a minute and only a couple run at once across the whole site, so you may see a short busy message at peak times. Wait a few seconds and try again.