SSL/TLS Certificate Checker

	Category	Description
🔐	Certificate Details	Common name, SANs, issuer, serial number, SHA-256 fingerprint, validity window and days until expiry.
🔗	Trust Chain	The full chain the server sends (leaf → intermediates → root) is validated against the operating system trust store.
🧪	Protocol Support	Live handshakes probe TLS 1.0, 1.1, 1.2 and 1.3 individually to detect deprecated protocol support.
🗝️	Key Strength	RSA key size, ECDSA curve or Ed25519, signature algorithm (SHA-1 detection) and 398-day certificate lifetime compliance.
⚡	Cipher Analysis	Records the negotiated cipher suite and tests whether legacy 3DES ciphers (SWEET32) are still accepted.
🌐	HTTP/2 & ALPN	Reads the ALPN negotiation of the real handshake to confirm HTTP/2 support.
🚦	HSTS Policy	Strict-Transport-Security header parsed for max-age, includeSubDomains and preload eligibility.
🛰️	OCSP Stapling	Detects whether the server staples a fresh OCSP response for faster, more private revocation checking.
🔄	HTTPS Redirect	Verifies that plain HTTP on port 80 redirects visitors to HTTPS.
📊	Security Grade	A letter grade from A+ to F using an SSL-Labs-style model over every check above, with a pass/warn/fail breakdown.

1. Real handshake - we open an actual TLS connection to the domain on port 443 (with SNI) and capture the complete certificate chain, the negotiated TLS version and cipher, the ALPN result, and any OCSP staple the server sends.
2. Protocol & cipher probes - short concurrent handshakes test each TLS version (1.0–1.3) separately and check whether legacy 3DES cipher suites are still accepted.
3. HTTP checks - HTTPS and plain-HTTP requests read status codes, redirect behaviour, HSTS directives and the Server header. Headers come from the domain's first response, never from a redirect target.
4. Scoring - every signal feeds a 0–100 score and letter grade (A+ … F), with an individual pass / warning / fail result for each check.

Tools.BD's SSL checker inspects the live TLS configuration of any domain over the exact connection your visitors' browsers make. It reads the presented certificate, validates the trust chain against trusted roots, probes protocol support and cipher security, and analyses HSTS, OCSP stapling, HTTP/2 and HTTPS redirect behaviour - then grades everything A+ … F.

What the checker examines

Certificate expiry and days remaining, issuer and organisation, subject alternative names, wildcard coverage, RSA/ECDSA/Ed25519 key strength, signature algorithm, SHA-256 fingerprint, CA/Browser Forum 398-day lifetime compliance, full chain validation, TLS 1.0–1.3 support, legacy 3DES ciphers, the negotiated cipher suite, ALPN/HTTP-2 negotiation, OCSP staples, and the exact HSTS directives (max-age, includeSubDomains, preload).

Why certificate expiry monitoring matters

An expired or misconfigured certificate triggers browser warnings, breaks integrations, and costs user trust - it is the most common cause of "Your connection is not private" errors. Check expiry dates regularly, keep renewal automation healthy, and use this tool after every renewal to confirm the new certificate really chains to a trusted root and covers your domain.

Common problems this tool detects

• Expired or soon-to-expire certificates - flagged with exact days remaining (urgent warnings below 15 days).
• Hostname mismatches - the certificate does not cover the requested domain.
• Incomplete chains - missing intermediates so some clients cannot build a trusted path.
• Weak keys or signatures - RSA below 2048 bits or a deprecated SHA-1 signature.
• Legacy protocols and ciphers - TLS 1.0/1.1 enabled or 3DES (SWEET32) suites still accepted.
• Missing or weak HSTS - no Strict-Transport-Security policy, or a max-age too short to matter.
• Plain-HTTP entry - port 80 serving content instead of redirecting visitors to HTTPS.

Who uses our SSL checker?

• Web administrators - verify renewals and catch broken chains before users do.
• Developers - debug TLS handshakes, ALPN/HTTP-2 negotiation and redirect behaviour.
• Security teams - audit protocol hygiene, HSTS policy and cipher strength.
• Compliance auditors - document certificate details, fingerprints and validity windows.

How do I check if a site's SSL certificate is valid?

Enter the domain (e.g. example.com) above and press Check. We connect to the server directly and show whether the certificate is currently valid, when it expires, who issued it, whether the trust chain validates against trusted roots, and if the certificate actually covers the domain you asked for.

What does the SSL grade mean (A+ to F)?

The grade combines certificate validity, key strength, signature algorithm, trust chain, protocol support, cipher security, HSTS and redirect behaviour into a 0–100 score. An A+ additionally requires TLS 1.3 without legacy protocols, a strong key, and an HSTS header with a preload-eligible max-age of at least 186 days.

Why does a certificate show "chain not trusted"?

The server must send its intermediate certificates along with the leaf. If they are missing, browsers cannot build a path to a trusted root. Fix it by serving the full chain - most ACME clients (certbot, acme.sh, Caddy) do this automatically.

How many days before expiry should I renew?

We flag certificates with fewer than 30 days remaining and warn urgently below 15 days. Automate renewal (ACME/Let's Encrypt renews at 60–75% of the lifetime) so expiry never becomes an issue.

What is HSTS and why does it matter?

HTTP Strict Transport Security tells browsers to only use HTTPS for your domain for a given max-age. With includeSubDomains and preload it prevents protocol-downgrade and cookie-theft attacks, and a preload-eligible max-age is a prerequisite for our A+ grade.

What is OCSP stapling?

Instead of every visitor asking a certificate authority whether the certificate is revoked, the server fetches that response itself and staples it to the handshake - faster for visitors and more private. Not all CAs support OCSP anymore (Let's Encrypt moved to short-lived certificates), so a missing staple is reported as information, not a failure.

What is the difference between SSL and TLS?

SSL was the predecessor protocol (SSL 3.0 and earlier are broken); TLS is its successor and what everything uses today. We still probe TLS 1.0/1.1 because servers offering them are considered outdated, and we report TLS 1.3 as the modern standard.

Is this SSL checker free?

Yes - unlimited free SSL/TLS checks with no signup. Results are cached briefly for speed; use the Refresh button (or add ?fresh=1) to force a live re-check.