Technical SEO / Security
SSL/TLS Certificate Analyzer
Enter a domain and we open a real TLS handshake to it — checking certificate expiry, hostname coverage, chain trust, key strength, signature algorithm and the negotiated TLS protocol, then grade the result A+ to F with the exact fix for each gap.
We connect directly to this domain on port 443 to read its TLS certificate — no login-walled or internal hosts. Nothing about the scan is stored beyond an anonymised usage count.
Why a valid certificate isn't just "has HTTPS"
Browsers don't just check that a certificate exists — they check that it covers the hostname being visited, that it hasn't expired, that it chains up to a trusted root, and that the algorithms protecting it haven't been broken for years. A certificate can be "installed" and still fail every one of those checks, and a single failure turns into a full-page browser warning most visitors won't click past.
This tool performs the actual TLS handshake your browser would perform — reading the live certificate chain and the protocol/cipher the server negotiated, not a cached expiry date. It flags a mismatched hostname, a missing intermediate certificate (fails on some mobile browsers even though desktop Chrome hides it), a self-signed or expired cert, RSA keys under 2048 bits, SHA-1/MD5 signatures, and TLS 1.0/1.1 — all deprecated or actively broken.
HTTPS has been a confirmed Google ranking signal since 2014, and browsers increasingly block or scare users away from insecure or misconfigured HTTPS pages — so a certificate issue isn't just a security problem, it's a traffic problem. Fix any fail-level finding immediately; treat warnings as this week's task.
Frequently asked questions
What does this tool actually check?
It opens a direct TLS connection to the domain you enter on port 443, retrieves the exact certificate chain the server presents and the TLS protocol/cipher it negotiates, then grades: hostname coverage (including wildcards), days until expiry, whether the chain is self-signed or missing intermediates, the leaf certificate's signature algorithm, its key type and size, and the negotiated protocol version.
My certificate is valid in the browser — why does this flag a problem?
The most common cause is an incomplete chain: your server may be serving only the leaf certificate without the intermediate certificate(s) that link it to a trusted root. Desktop Chrome and Firefox often paper over this by caching intermediates they've seen before — but a fresh device or older phone browser will reject the connection outright. Reinstall the full chain your CA provided, not just the leaf.
Why is TLS 1.0/1.1 flagged if my site still loads fine?
Most current browsers still support the old handshake for compatibility, so pages load — but TLS 1.0 and 1.1 have known cryptographic weaknesses, are disallowed under PCI-DSS for card payments, and are being actively phased out. Fixing this is a server/load-balancer configuration change, not a certificate reissue.
Does a perfect score mean my site is fully secure?
No — this tool only grades the TLS transport layer: the certificate and handshake. It says nothing about your application code, HTTP response headers, or server software. A perfect certificate score is a prerequisite for a secure site, not proof of one.
Does this tool store the domains I check?
No certificate content is stored. We log an anonymised usage count for the tool itself and a short-lived per-IP rate limit to prevent abuse.