# SSL Certificate Checker | Inspect trust, names and expiry

Check a site's TLS certificate chain, hostname, expiry and negotiated protocol, or inspect pasted PEM certificates locally. See verification limits clearly.

Canonical: https://tamperbox.dev/ssl-checker

Docs: https://docs.tamperbox.dev/tools/ssl-checker.md

Updated: 2026-10-26

Reviewed: 2026-10-21

## How it works

Enter a host name and our server opens one TLS connection on port 443, or on the mail port you add, sends the host name as SNI, verifies the chain against public roots and returns the negotiated protocol with every certificate the server sent. Paste PEM certificates or `openssl s_client -showcerts` output and they are read in your browser. Each certificate is drawn on one time axis with the moment of the check, so expiry, a short intermediate and the renewal window are visible at a glance, and the result names the problem a browser would warn about.

The full method, every rule and worked examples are on [docs.tamperbox.dev](https://docs.tamperbox.dev/tools/ssl-checker/).

## Limits and interpretation

One connection is made, from one location. The key exchange group is reported for port 443 only. Revocation (OCSP and CRL) is not checked, and only the protocol and cipher this connection negotiated are known, not every version the server allows. Pasted certificates and verification codes are reported as supplied, not independently verified against roots. Browser trust stores and policies can differ from the probe’s. Lifetime guidance uses the certificate start date as an issuance-date estimate: the public TLS limit is 200 days from 15 March 2026, 100 days from 15 March 2027, and 47 days from 15 March 2029; earlier certificates use 398 days. Private certificates follow their own policies. Nothing is stored.

## Frequently asked questions

### What does an SSL certificate checker inspect?

It inspects a TLS certificate chain, hostname coverage, dates, keys and the negotiated connection. SSL is a common search term; modern connections use TLS.

### Why can a valid certificate show a hostname mismatch?

The requested hostname is not covered by the certificate's names. Check the exact host and endpoint configuration, including SNI.

### Does this check certificate revocation?

No. OCSP and CRL revocation checks are not performed. Pasted certificates are parsed locally and are not independently validated against a trust store.

## References

[CA/Browser Forum TLS Baseline Requirements, section 6.3.2](https://cabforum.org/working-groups/server/baseline-requirements/requirements/#632-certificate-operational-periods-and-key-pair-usage-periods) · [TLS 1.3: RFC 9846, section 4.5.1](https://www.rfc-editor.org/rfc/rfc9846#section-4.5.1) (obsoletes RFC 8446) · [X.509 certificates: RFC 5280, section 6.1](https://www.rfc-editor.org/rfc/rfc5280#section-6.1) · [Service identity: RFC 9525, section 6.3](https://www.rfc-editor.org/rfc/rfc9525#section-6.3) (obsoletes RFC 6125) · [TLS 1.0 and 1.1 deprecated: RFC 8996](https://www.rfc-editor.org/rfc/rfc8996).