tamper[box]

SSL Certificate Checker

Inspect trust, names and expiry

Browser warning, or a renewal you doubt? One connection shows the certificate this server sends and its days left.

Check a site's TLS certificate chain, hostname, expiry and negotiated protocol, or inspect pasted PEM certificates locally. See verification limits clearly. Jump to: What does it mean?, How to fix it, Break it, Ask your agent.

    Pasted certificates stay in your browser. A PEM chain or openssl output is read here and never uploaded.

    A host name means one connection from our server. It opens TLS on the port you give, keeps nothing, and returns what the server sent.

    Findings

      Take it further

        Certificate chain

          Names it covers

            Connection

            Certificate details

            Chain as PEM

            What this result means

            Written for this result.

            • The TLS certificate for tamperbox.dev passes every check. Checked with Tamperbox on port 443, TLS 1.3 negotiated.

What would a sensible next step be to harden this host's TLS beyond the certificate?

The check came from Tamperbox /ssl-checker. Its method and limits are at https://tamperbox.dev/ssl-checker.md; read them before relying on the result.

              Connect Tamperbox MCP and the agent can run this check itself, with the same limits.

            • The page rewrites this card with the current certificate evidence each time it opens.

              • Serve the full chain file (fullchain.pem), never the certificate alone.
              • Let an ACME client renew automatically and reload the server after each renewal.
              • Prefer ECDSA P-256 keys; keep TLS 1.2 and 1.3 only.
              • Monitor expiry with a check that runs where you will see it fail.

            • Use the current finding and its evidence before changing a certificate or server configuration.

            • Lifetime guidance uses the start date as an issuance-date estimate against the public TLS limits (398, 200, 100 and 47 days by date of issue). Private certificates follow their own policies.

              Nothing you enter is stored.

            How it works

            Enter a host name and our server opens one TLS connection on port 443, or on the mail port you add, sends the host name as SNI, verifies the chain against public roots and returns the negotiated protocol with every certificate the server sent. Paste PEM certificates or openssl s_client -showcerts output and they are read in your browser. Each certificate is drawn on one time axis with the moment of the check, so expiry, a short intermediate and the renewal window are visible at a glance, and the result names the problem a browser would warn about.

            The full method, every rule and worked examples are on docs.tamperbox.dev.

            Limits and interpretation

            One connection is made, from one location. The key exchange group is reported for port 443 only. Revocation (OCSP and CRL) is not checked, and only the protocol and cipher this connection negotiated are known, not every version the server allows. Pasted certificates and verification codes are reported as supplied, not independently verified against roots. Browser trust stores and policies can differ from the probe’s. Lifetime guidance uses the certificate start date as an issuance-date estimate: the public TLS limit is 200 days from 15 March 2026, 100 days from 15 March 2027, and 47 days from 15 March 2029; earlier certificates use 398 days. Private certificates follow their own policies. Nothing is stored.

            Frequently asked questions

            What does an SSL certificate checker inspect?

            It inspects a TLS certificate chain, hostname coverage, dates, keys and the negotiated connection. SSL is a common search term; modern connections use TLS.

            Why can a valid certificate show a hostname mismatch?

            The requested hostname is not covered by the certificate's names. Check the exact host and endpoint configuration, including SNI.

            Does this check certificate revocation?

            No. OCSP and CRL revocation checks are not performed. Pasted certificates are parsed locally and are not independently validated against a trust store.

            References

            CA/Browser Forum TLS Baseline Requirements, section 6.3.2 · TLS 1.3: RFC 9846, section 4.5.1 (obsoletes RFC 8446) · X.509 certificates: RFC 5280, section 6.1 · Service identity: RFC 9525, section 6.3 (obsoletes RFC 6125) · TLS 1.0 and 1.1 deprecated: RFC 8996.

            Are you an AI agent? You are in the right place.

            This page and every tool are available as plain text with their methods and limits, and the same checks run over MCP.