DomainsMesh
Free tool · no account

SSL Checker

Connect to a host and read the certificate it actually presents right now — validity, hostname coverage, chain of trust, negotiated TLS version and key details.

Try an example:
Ready to check

Enter a hostname above to connect and read its certificate. No account needed.

The four things that actually break HTTPS

Nearly every certificate warning a browser shows traces back to one of these.

Expired or not yet valid

Every certificate has a validity window. Past valid_to, or before valid_from, browsers refuse the connection outright — there is no partial trust for a certificate outside its dates.

Wrong hostname

A certificate only covers the exact names listed on it. A certificate for example.com does not cover mail.example.com unless that name (or a matching wildcard) is also listed.

Chain or trust problem

A certificate signed by an authority the connecting client doesn't trust — or missing an intermediate certificate needed to link it to one — is rejected even if every other detail is correct.

Configuration issue

A deprecated protocol version, a missing intermediate, or a certificate that doesn't match how a site is actually served can all produce warnings without any one of them meaning HTTPS is entirely broken.

Certificates expire faster than teams remember to look.

SSL Checker shows the certificate a host is presenting right now. Domain Monitor is the account-based feature that checks on a schedule and alerts you before a certificate expires or when it changes — no manual re-checking required.

Explore Domain Monitor

How the check works

This tool opens a real TLS connection to the host you enter, on port 443 unless you specify another, and reads whatever certificate the server presents during the handshake. Nothing is looked up from a cache or a third-party database — the connection happens server-side, at the moment you run the check.

Reading the report: the status at the top answers the question that actually matters — is this certificate currently valid for this hostname. Everything below it (chain of trust, protocol, key details) explains why, not whether.

The chain problem: a certificate is rarely trusted on its own — it chains up through one or more intermediate certificates to a root that browsers trust by default. A server that forgets to send an intermediate produces a certificate that is perfectly real but still shows as untrusted to most visitors.

SSL questions

Does this tool check the live certificate, or a cached record?

Every check opens a real TLS connection to the host you enter and reads whatever certificate it presents at that moment. A result is cached for a short time afterward so repeat checks on the same host stay fast, but it always starts from a fresh connection.

Why does it say the hostname is not covered?

A certificate is only valid for the exact hostnames listed on it (its Subject Alternative Names, or its Common Name if it has no SANs at all). If the host you checked isn't one of those names — including a missing or extra subdomain — browsers will show a warning even if the certificate itself is otherwise fine.

What does "chain could not be verified" mean?

It means the certificate wasn't issued by, or doesn't chain up to, one of the certificate authorities this check trusts by default — for example a self-signed certificate, or an incomplete chain missing an intermediate certificate. The certificate can still be genuine; it just won't be trusted automatically by browsers either.

Can I check a non-standard port?

Yes — enter the host as host:port, for example mail.example.com:465. If you don't specify a port, 443 (standard HTTPS) is used.

Does this replace ongoing SSL monitoring?

No. This tool answers what the certificate looks like right now. Domain Monitor checks your domains on a schedule and alerts you before a certificate expires or when it changes, without you having to run a manual check.