SSL Certificate Check
Complete a real TLS handshake with any domain and inspect its certificate: expiry, issuer, SANs, TLS version, cipher suite and HTTP/2 support.
Frequently asked questions
It performs a real TLS handshake with the target from our server and reports the certificate details along with the negotiated TLS version, cipher suite and ALPN protocol. Only the handshake and certificate are read — no page content is downloaded.
When validation passes you get the expiry countdown and full certificate details. When it fails, the exact problem is named: expired, not yet valid, hostname mismatch, self-signed, or an untrusted chain. The raw OpenSSL error code is shown as well for reference.
During the TLS handshake the probe offers h2 and http/1.1 through ALPN, the same negotiation browsers perform. If the server selects h2, HTTP/2 is supported. HTTP/3 runs over QUIC (UDP) and is not checked yet.
Yes. For IP targets hostname matching is skipped, but expiry and chain trust are still verified — useful for inspecting the certificate a backend serves before DNS is pointed at it.
The handshake is made from our server. Behind a CDN or a hostname with multiple addresses, different edge nodes can serve different certificates; the check reports the IP it actually connected to. Private and reserved addresses are never probed.
30 checks per day per IP address. The daily quota resets at 00:00 UTC+8.
No. Query contents are never stored.