SSL Certificate Checker

Inspect a public TLS endpoint's leaf certificate, hostname match, validity window, system trust, key and signature strength, negotiated protocol/cipher, chain signatures, SANs, fingerprints and SPKI pin—without sending the hostname to a commercial checker.

SSRF-hardened backend.
The deployed checker resolves and pins public IPs, blocks private/reserved targets, rate-limits requests, and only permits common TLS ports.

Live endpoint

Preview demo

Hostname

TLS port

Ready.

Pinned resolved IP

—

Connection health

—

System trust—

Hostname—

Days left—

Negotiated TLS—

Subject

—

Issuer —

Subject Alternative Names

Presented certificate chain

Fingerprints & pinning

SHA-256 fingerprint—

SPKI pin—

Serial—

Signature—

SPKI pins are useful for diagnostics and asset identity checks. Do not deploy HTTP Public Key Pinning (HPKP); browsers removed it years ago.

Security checks

TLS & certificate diagnostics

Cipher

—

TLS 1.2 probe

—

TLS 1.3 probe

—

OCSP / AIA

—

CRL

—

Reproduce with OpenSSL

—

What is verified

The backend performs an unverified pinned-IP handshake to inspect the presented certificate, then a separate verified handshake using the server trust store and expected hostname. Hostname matching is calculated independently from subjectAltName identifiers using RFC 9525 rules. The Common Name is displayed only as legacy metadata and is not accepted as a service identity.

Chain signature links, key size, weak signature algorithms, current validity, SANs, fingerprints and negotiated crypto are reported separately rather than collapsed into a misleading single grade.

Safe network behavior

Private, loopback, link-local, reserved and multicast targets are blocked before connection. The backend connects to the already-resolved public IP while retaining the requested hostname for SNI and certificate verification, reducing DNS-rebinding risk.

The hosted tool makes a real TLS connection. Offline previews use clearly labelled demo certificate data.