PulseTrace
Start free
All free tools
Free tool

SSL certificate checker — expiry, chain, hostname match and TLS version

Enter a hostname and PulseTrace performs a real TLS handshake, then shows what a browser would see: who issued the certificate, when it expires, whether the chain is trusted and the name matches, and which protocol and cipher were negotiated.

Monitor this continuously

Get alerted before this certificate expires — 1 day to 1 month ahead, your choice — from every region, on every plan including Free.

Start free TLS monitor

How to read the result

  1. 1Days left counts down to the certificate's notAfter. Automated renewal (ACME) normally runs at 30 days; under 7 days means it has been failing for weeks. PulseTrace's TLS monitor alerts 7 days ahead by default (1 day to 1 month configurable).
  2. 2Chain trusted means the server sent every intermediate a client needs. A valid certificate with a missing intermediate still fails on some clients.
  3. 3Hostname match checks the Subject Alternative Names, including wildcards. A mismatch is a hard browser error even when everything else is fine.
  4. 4TLS 1.3 should be negotiated on a modern server; TLS 1.2 alone is acceptable, anything older is not.

Questions

Is this the same as SSL Labs?
It is the quick version: expiry, chain, hostname, key, signature and protocol. SSL Labs (and PulseTrace's SSL/TLS Security monitor) additionally probes legacy protocols, weak cipher suites, revocation and more, and grades the result.
Can I check a non-443 port?
Yes — append the port: mail.example.com:465 for SMTPS, :993 for IMAPS, :8443 for an admin panel. STARTTLS ports (25, 587, 143) are not supported because they need a protocol handshake first.
Why does it say the chain is not trusted when my browser is happy?
Browsers cache intermediates from other sites; a fresh client does not. If the server omits an intermediate, some clients (curl, mobile apps, mail servers) will fail. Fix the server's chain file.
Does the check use my IP?
No — the handshake is made from PulseTrace's server, so the certificate you see is what a public client sees.

Other free tools

Security headers graderDNS lookupIs it down?SLA & uptime calculatorCron expression builderSSL certificate monitoring →