Omikuji Tools Text & Dev

SSL Certificate Checker

Check a server's SSL/TLS certificate: expiry, issuer, SANs, the certificate chain and which TLS versions are enabled.

✨ Features

  • Days until expiry, issuer, SANs, serial number and SHA-256 fingerprint of the server certificate
  • The certificate chain (intermediates) and the verification result: expired, hostname mismatch, self-signed or broken chain
  • Whether TLS 1.0, 1.1, 1.2 and 1.3 are enabled, tested with real connections
  • Checks HTTPS (443) plus SMTPS (465), IMAPS (993), POP3S (995) and 8443. Results can be shared as a URL

🪄 Use cases

Avoid missed renewals

Look at the days remaining to confirm automatic renewal is still working.

Diagnose a browser warning

Tell an expired certificate from a hostname mismatch or a missing intermediate.

Verify a migration or renewal

Confirm the new certificate is being served by checking the issuer and serial number.

Confirm old TLS is off

See with a real connection whether TLS 1.0 / 1.1 are really disabled.

🔒 Privacy

The certificate is fetched by our probe server in Japan, which connects to the host you enter. The host name and port are used only for that check — they are not stored or logged on our server and are not sent to any third-party service. The host name is kept only in the URL fragment (never sent to the server) and in your browser's localStorage.

❓ FAQ

My browser is fine, but the result says the chain could not be verified

The server is most likely not sending its intermediate certificate. Chrome and Firefox fetch missing intermediates on their own (AIA fetching), so they show no warning, but curl, older Android versions and many apps do not and fail to connect. Serve the intermediate together with the server certificate (a "fullchain" file).

What is the reference time for the days remaining?

The difference between the time of the check and the certificate's notAfter date (UTC), rounded down to whole days. The expiry date shown is converted to your browser's time zone.

What is the difference between SAN and CN?

The CN (common name) is the certificate's name field and used to be checked against the host. Modern browsers look only at the SAN (subjectAltName) and ignore the CN. Connecting with a host name that is not in the SAN gives a hostname mismatch even if the CN says otherwise.

Can I check port 25 or 587 (SMTP)?

No. Ports 25 / 587 / 143 / 110 start in plain text and upgrade with STARTTLS, which is a different procedure from ports that speak TLS from the first byte (443 / 465 / 993 / 995 / 8443). To check a mail server's certificate, use implicit-TLS port 465 (SMTPS) or 993 (IMAPS).

Where does the check run from?

Our probe server in Japan connects directly to the host. CDNs and regional edges may serve different certificates, so the result can differ from what other locations see.

🔗 Related tools

What Is My IP IP Address Lookup DNS Lookup robots.txt Checker HTTP Status Codes HLS/DASH Stream Checker HTML Escape / Unescape Base64 Converter

Check a certificate

You can paste a full URL (https://example.com/path) — only the host name is used. Supported ports: HTTPS (443), SMTPS (465), IMAPS (993), POP3S (995) and 8443.

How to read the result

  • Expiredthe certificate's notAfter date has passed. Browsers show a full-page warning, so renew it right away. Let's Encrypt certificates last 90 days and are normally renewed automatically once fewer than 30 days remain.
  • Hostname mismatchthe host you connected to is not listed in the certificate's SAN. A typical case is a certificate that covers only one of www / non-www.
  • Self-signedthe certificate was signed by itself, not by a certificate authority. Fine for internal or test use, but browsers warn on public sites.
  • Chain problemthe server is not sending its intermediate certificate, or the root CA is not in the trust store. Some browsers cope, but curl and older devices fail. Serve the intermediate certificate together with the server certificate.
  • Days remaining30 or more is fine; 7 or fewer means you should check that automatic renewal is still working.