SSL/TLS Certificate Checker
Inspect a domain's TLS certificate — validity, issuer, subject/SANs and protocol version.
What an SSL/TLS certificate is
A TLS certificate (the successor to the old SSL — the name "SSL" is still used casually, but the protocol in use today is always TLS) is the digital document that assures the browser of two things: who is on the other end of the connection (the domain named in the certificate) and a public key to encrypt the HTTPS traffic. Issued by a certificate authority (CA), it has an expiration date — the padlock in the browser only shows up when the presented certificate is valid for that domain and hasn't expired yet.
How this tool works
This tool opens, from the Nexinon server, a real TLS connection on the given domain's port 443 and reads the certificate it presents — the same one the browser receives when opening the site, but without requiring trust in the issuing chain. Unlike visiting the site in a browser, it shows the certificate as it is, even when expired or self-signed (no trust validation happens in this version): the goal is inspection, not browsing.
Validity and wildcard certificates
"Days remaining" counts from the current date and time to the end of validity ("Valid until") — a negative number (shown as "expired N days ago") means the certificate has already lapsed. A wildcard certificate covers a domain and all of its first-level subdomains at once (e.g. *.example.com covers www.example.com and blog.example.com, but not sub.blog.example.com) — identified by the asterisk in the common name or in one of the alternative names (SAN).
Frequently asked questions
Because this version's goal is to inspect the certificate exactly as presented, not validate whether a browser would trust it — the same information a browser's "view certificate" shows, but without requiring a valid trust chain just to see it.
It's the standard HTTPS port and covers the overwhelming majority of real use cases for this tool. Checking an alternative port (e.g. an internal service on 8443) is out of scope for this version.
Subject Alternative Name — the list of domain names the certificate is valid for, besides the main common name. Most modern certificates rely on SAN instead of just the common name, including to cover variations like "example.com" and "www.example.com" in the same certificate.
Out of scope for this version, by product decision — the tool inspects the presented certificate without validating the issuing chain up to a trusted root. A self-signed or expired certificate shows up normally, with the data it contains.
Not necessarily — it's the IP the Nexinon server got when resolving the domain at check time. Services behind load balancing or a CDN can answer different queries with different IPs.