Technical SEO / Security
SSL/TLS Certificate Analyzer
Enter a domain and we open a real TLS handshake to it — checking certificate expiry, hostname coverage, chain trust, key strength, signature algorithm and the negotiated TLS protocol, then grade the result A+ to F with the exact fix for each gap.
We connect directly to this domain on port 443 to read its TLS certificate — no login-walled or internal hosts. Nothing about the scan is stored beyond an anonymized usage count.
Why a valid certificate isn't just "has HTTPS"
Browsers don't just check that a certificate exists — they check that it covers the hostname being visited, that it hasn't expired, that it chains up to a trusted root, and that the algorithms protecting it haven't been broken for years. A certificate can be "installed" and still fail every one of those checks, and a single failure turns into a full-page browser warning most visitors won't click past.
This tool performs the actual TLS handshake your browser would perform — reading the live certificate chain and the protocol/cipher the server negotiated, not a cached expiry date. It flags a mismatched hostname (common after adding a subdomain without reissuing the cert), a missing intermediate certificate (fails on some mobile browsers even though desktop Chrome hides it), a self-signed or expired cert, RSA keys under 2048 bits, SHA-1/MD5 signatures, and TLS 1.0/1.1 — all deprecated or actively broken.
HTTPS has been a confirmed Google ranking signal since 2014, and browsers increasingly block or scare users away from insecure or misconfigured HTTPS pages — so a certificate issue isn't just a security problem, it's a traffic problem. Fix any fail-level finding immediately; treat warnings (expiring soon, incomplete chain) as this week's task.
Frequently asked questions
What does this tool actually check?
It opens a direct TLS connection to the domain you enter on port 443, retrieves the exact certificate chain the server presents and the TLS protocol/cipher it negotiates, then grades: hostname coverage (including wildcards), days until expiry, whether the chain is self-signed or missing intermediates, the leaf certificate's signature algorithm, its key type and size, and the negotiated protocol version.
My certificate is valid in the browser — why does this flag a problem?
The most common cause is an incomplete chain: your server may be serving only the leaf certificate without the intermediate certificate(s) that link it to a trusted root. Desktop Chrome and Firefox often paper over this by caching intermediates they've seen before, so it looks fine to you — but a fresh device, an older phone browser, or an API client with no cache will reject the connection outright. Reinstall the full chain your CA provided, not just the leaf.
Why is TLS 1.0/1.1 flagged if my site still loads fine?
Most current browsers still support the old handshake for compatibility, so pages load — but TLS 1.0 and 1.1 have known cryptographic weaknesses, are disallowed under PCI-DSS for card payments, and are being actively phased out. Fixing this is a server/load-balancer configuration change (disable the old protocol versions), not a certificate reissue.
Does a perfect score mean my site is fully secure?
No — this tool only grades the TLS transport layer: the certificate and handshake. It says nothing about your application code, HTTP response headers, or server software. A perfect certificate score is a prerequisite for a secure site, not proof of one.
Does this tool store the domains I check?
No certificate content is stored. We log an anonymized usage count for the tool itself and a short-lived per-IP rate limit to prevent abuse — the domain and certificate details you see are not kept after your session.