🔒 SSL Certificate Checker
Check SSL/TLS certificate details for any domain — HTTPS, HSTS, redirect, TLS grade
About this tool
Enter a hostname and the tool probes whether HTTPS is reachable from your browser, how fast the
TLS handshake completes, whether the plain HTTP version redirects to HTTPS, and whether the site
sends an HSTS header. Type a domain like cloudflare.com and you get an overall grade
(A–F) plus a breakdown: HTTPS reachable, TLS handshake in ms, port 443 open, HTTP→HTTPS redirect,
and HSTS status.
Example: checking example.com typically returns grade A
— HTTPS reachable in under 500 ms, port 443 open, with an HTTP→HTTPS redirect. Checking a domain
that only serves plain HTTP returns grade F with "HTTPS not reachable" and a list
of likely causes (expired cert, self-signed, name mismatch, server down).
The domain is saved in the URL (?domain=…) so you can bookmark or share a specific
check. Recent checks are stored locally and clickable to re-run. Browsers intentionally hide the
raw X.509 fields (issuer, serial, expiry, chain) from JavaScript, so for a full certificate report
the results link to Qualys SSL Labs and CryptCheck.
FAQ
Why can't the tool show the certificate issuer, expiry date, or chain? ›
Browsers do not expose raw X.509 certificate fields to JavaScript. A page can only observe whether the TLS handshake succeeded, how long it took, and the response headers. To inspect issuer, subject, SAN, serial, signature algorithm, and the full chain, use the Qualys SSL Labs or CryptCheck links in the result.
What do the grades A, B, C, and F mean? ›
Grade A means HTTPS is reachable and the TLS handshake completed in under 500 ms. B means 500–1500 ms, C means over 1500 ms, and F means HTTPS was not reachable at all. The grade is a quick reachability and speed signal — it is not a full cryptographic grade like the one Qualys SSL Labs produces.
How does the HTTP→HTTPS redirect detection work? ›
The tool makes a no-cors request to the plain http:// version of the host. Because the response body is opaque, it cannot read the Location header — but a successful fetch to http:// combined with a successful HTTPS handshake strongly suggests an HTTP endpoint exists, and the HSTS header (when present) confirms the site wants HTTPS only. A failed http:// fetch on a working HTTPS site often indicates HSTS preload.
The site clearly has HTTPS but the tool says "HTTPS failed". Why? ›
The most common causes are a self-signed certificate, a certificate with a hostname mismatch, an expired certificate, or a server that requires SNI and is not reachable from your network. Browser CORS and mixed-content rules can also block the probe. Try the Qualys SSL Labs link for a server-side scan that bypasses these browser limits.
How do I decode the raw certificate of a site I can connect to? ›
This tool tests reachability and speed but cannot show issuer, SANs, or expiry because browsers hide X.509 fields from JavaScript. Use the <a href="/ssl-cert-decoder" class="text-accent hover:underline">SSL Certificate Decoder</a> — paste the PEM from openssl and it shows every field: version, serial, issuer, subject, validity, SANs, and public key.