SSL certificate check
Shows a domain's SSL certificate as a browser sees it: the issuer, the validity window, the names it covers and the chain up to the root authority.
Need another tool?
Pick one of the 25 belowOutput
What the SSL certificate check shows
The SSL certificate check connects to port 443 of the domain from the IPVIEW server, presents the domain name in the handshake as a browser does, and reports the certificate returned: subject, issuer, validity window and days remaining, every other name it covers, the chain up to the root authority, the protocol and cipher negotiated, the serial number and the SHA-256 fingerprint. The name is resolved first and the address connected to is on the page; reserved addresses are refused.
The connection is made without rejecting an invalid certificate, because the point is to report on it rather than gate on it. Trust is judged separately against this server's trust store and shown as Chain trusted yes or no with the reason. A site behind a CDN or load balancer may hand a different certificate to a different place; what is shown is what this server received.
How to read the result
The banner is about time: valid for another N days, expires in N days when under fifteen remain, expired, or dates could not be read, which is reported as unknown rather than expired. Chain trusted no is the row that matters when a browser warns: the reason beside it names a self-signed certificate, an unknown issuer, a hostname mismatch or an incomplete chain. The chain table lists each certificate's subject and issuer up to the root; a single entry with an untrusted verdict usually means the server is not sending its intermediate.
Other names on this certificate lists the subject alternative names, up to forty with a note if more were cut; the name you typed must be among them or match a wildcard, or the certificate is not valid for it. The protocol should read TLSv1.2 or TLSv1.3; anything older is a finding.
When it is useful
A browser shows a certificate warning on your site and you want to know why without clicking through: expired, wrong name, missing intermediate or an untrusted authority each read differently here. If renewal is failing, the CAA record tool shows which authorities may issue for the domain.
Before a certificate expires, as a quick check of the days remaining, and after installing a new one, to confirm the server hands out the new certificate with its full chain. If the handshake fails outright, the Reachability check or Check one port on 443 separates a server problem from a path problem.
Common questions
What does Chain trusted mean?
That the certificate chains up to a root authority this server trusts with no error on the way. No means a browser would most likely warn too; the reason says whether the issuer is unknown, the chain incomplete, the name wrong or the certificate self-signed.
Why does the check show a different certificate from my browser?
The site is behind a CDN or several servers, and the one that answered this server is not the one that answers you. The address row says which host was connected to.
How many days before expiry should I renew?
Automated renewal typically runs at thirty days remaining. The banner turns to a warning under fifteen, which is late for a manual renewal and a sign that automation has failed.
Does the check work on ports other than 443?
No. It connects to 443 with the domain as server name. For a mail server on another port, Check one port says whether the port answers but does not read its certificate.
Limits. The DNS, WHOIS and SSL tools allow up to 20 requests a minute per IP address. Ping, traceroute and MTR send real packets to their target, so they allow 6 a minute.
The port check runs only against your own IP address. That is deliberate: the question people actually have, "is this port reachable from outside?", is answered by it, while this server cannot be used to scan anyone else's network.
Private and reserved addresses. These are refused by the tools that really connect to their target: the SSL check, ping, traceroute, MTR and the port check. The DNS tools have no such limit, because they only ask a nameserver a question and never connect to the address itself.