Home / Security Tools / SSL / TLS Check
Security Tools
Chain, expiry, protocols and cipher suites.
The SSL / TLS Check inspects the certificate chain served by a host on port 443, reporting the negotiated protocol and cipher, the chain, the issuing CA, and the days until the leaf certificate expires.
Enter a domain name (example.org) and run the tool. The probe completes a TLS handshake and inspects the presented certificate chain.
Input: Domain — e.g. example.org.
The output shows the negotiated TLS version and cipher, then each certificate in the chain with its subject, issuer, validity dates and days remaining. A chain that does not validate, an expired certificate, or a weak cipher (TLS 1.0, RC4) is a security issue to fix before it causes browser warnings or fails compliance.
→ Verify a site’s TLS certificate chain and expiry.
→ Confirm the negotiated TLS version and cipher are modern.
→ Catch a missing intermediate causing validation failures.
→ Audit certificate coverage across all SANs before expiry.
TLS 1.2 at minimum, with TLS 1.3 preferred. Disable TLS 1.0 and 1.1 — they are deprecated and vulnerable. Most modern clients negotiate TLS 1.3, which is faster and more secure than 1.2.
The server is not sending the intermediate certificate(s) needed to chain the leaf to a trusted root. Some browsers cache intermediates and still work, but others (and most CLI clients) fail validation. Install the full chain (leaf + intermediates) on the server.
Renew at least 30 days before expiry so there is buffer for automation failures. Many setups auto-renew at 20–30 days remaining. An expired certificate triggers browser warnings and breaks API clients and automated checks.