SSL Certificate Checker

How the live TLS handshake works under the hood

CertFleet's SSL checker is fundamentally different from passive aggregators. Instead of relying purely on historical records or cached database values, our network of globally distributed probes opens a live TCP socket on port 443, initiates a real TLS cryptographic handshake with the target hostname, and retrieves the active X.509 certificate.

This live approach guarantees that you see exactly what a browser or API client receives when connecting right now. We read the certificate's metadata directly from the cryptographic payload: the Issuer Common Name (CN), the negotiated TLS protocol version (e.g., TLS 1.3), the exact cryptographic signature algorithm (such as ECDSA or RSA), and the full list of Subject Alternative Names (SANs). We then cross-reference these findings with public Certificate Transparency (CT) logs to retrieve historical issuance events.

Common SSL/TLS configuration errors and how to diagnose them

A broken SSL/TLS configuration will instantly block your users from visiting your site, causing severe trust and revenue loss. The most common errors include:

• Expired Certificate (Not After Date Passed): All modern certificates have a maximum lifetime of 398 days (90 days for automated Let's Encrypt certificates). Once this date passes, browsers block all traffic with an ERR_CERT_DATE_INVALID error. Our checker parses this field and displays a clear countdown.
• Hostname Mismatch (Subject Alternative Name Failure): A certificate is only valid for the specific hostnames listed in its Subject Alternative Names (SANs) or Common Name. If you point api.example.com to a server running a certificate only valid for example.com, browsers will throw SSL_ERROR_BAD_CERT_DOMAIN.
• Incomplete Certificate Chain (Missing Intermediates): Servers must present not just their own "leaf" certificate, but also any "intermediate" certificates required to establish a path of trust up to a trusted Root Authority. While some desktop browsers cache and patch missing intermediates, mobile clients, APIs, and command-line tools like curl will instantly fail with an untrusted chain error.
• Self-Signed or Untrusted Authority: Certificates generated internally or by untrusted private authorities will show an ERR_CERT_AUTHORITY_INVALID error on public clients. Our checker verifies if the presenting chain is trusted by major public root stores.

Manual Diagnostics vs. Continuous Automated Monitoring

Checking your certificate manually is a critical diagnostic step during a deployment or an incident. However, manual checks cannot prevent downtime because they depend on human memory. SSL certificates expire silently in the background, registrar auto-renewals fail due to expired credit cards, and automated ACME renewal scripts crash due to DNS rate limits.

This is why professional operations teams pair manual debugging with continuous automated monitoring. A dedicated monitor tests your handshakes every single hour and fires notifications directly to your team's communication channels weeks before any real failure occurs.

Frequently Asked Questions