SSL Certificate Checker: Expiry, Chain and Names
Check a site's certificate expiry, chain and trust.
Use via API
Connect to a public host over TLS and report whether its certificate is trusted, the protocol and cipher, and the chain with expiry dates and days left. Send JSON, get JSON back; this one reaches the network from PithLab’s server.
POST https://pithlab.com/api/v1/tools/ssl-checker
curl https://pithlab.com/api/v1/tools/ssl-checker \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"host":"example.com"}'About the SSL Certificate Checker
Check a website's SSL/TLS certificate: whether browsers trust it, when it expires, which names it covers, who issued it, the full chain, and the TLS version in use.
How to use the SSL Certificate Checker
- Enter a domain, such as example.com, or a URL. Add a port such as :8443 if the site doesn't use 443.
- Press Check. PithLab's server opens a TLS connection and reads the certificate the site presents.
- See whether the certificate is trusted, when it expires, which names it covers and every certificate in the chain.
Examples
Input
example.com
Output
Trusted, TLSv1.3, expires in N days, covers example.com
Frequently asked questions
What does "not trusted" mean?
Browsers will warn visitors. Common causes are an expired certificate, a certificate for a different name, a self-signed certificate, or a server that doesn't send the intermediate certificates in its chain.
How early should I renew?
Automated certificates such as Let's Encrypt renew about 30 days before expiry. If a certificate has under 14 days left, renewal has probably failed and is worth checking now.
Can I check a certificate file instead of a live site?
Yes, paste it into the certificate decoder. It reads PEM certificates in your browser without connecting anywhere.