Checks the certificate, chain, name match, expiry and strength.
A certificate problem shows visitors a full-page warning, stops API clients, and breaks mail delivery between servers. The causes are usually small: a missing intermediate certificate, a name that is not on the certificate, an expiry nobody tracked, or one server behind a load balancer holding an old certificate.
Enter a host name to see the certificate the server presents, the chain it sends, whether it validates, and whether the name matches. Add the protocol and cipher review to see which TLS versions and suites the server accepts.
Almost always an incomplete chain. Browsers fetch a missing intermediate themselves, which hides the fault. curl, Java, mobile apps and mail servers do not. Install the intermediate on the server.
Publicly trusted certificates were capped at 398 days in 2020. From 15 March 2026 the cap is 200 days, falling to 100 in 2027 and 47 in 2029, so renewal has to be automatic.
The one on our server, which follows the major public authorities. A private or internal CA will show as untrusted.
TLS-wrapped services only: 443 and 8443 (HTTPS), 465 (SMTPS), 993 (IMAPS), 995 (POP3S) and 636 (LDAPS). Add the port after the name, for example mail.example.com:993.