SSL/TLS Certificate Inspector
Enter a hostname for a server-side TLS check: the presented certificate, its hostname and dates, and whether the chain the endpoint sent reaches a trusted root. The visitor’s own trust store and OCSP are not read.
·
Enter a hostname for a server-side TLS check: the presented certificate, its hostname and dates, and whether the chain the endpoint sent reaches a trusted root. The visitor’s own trust store and OCSP are not read.
Enter a public hostname and press Inspect certificate. The VoriTools server resolves the name, connects to port 443 and reads the certificate the endpoint presents: issuer, subject, names, validity window, SHA-256 fingerprint, negotiated protocol, cipher and handshake time.
Below that come two kinds of findings: the name and date checks a browser also performs, and whether the certificates the endpoint sent build a path to a root in this server’s CA store. Nothing is stored, and checks are limited to 30 per minute.
The name check follows the browser rule: *.example.com covers exactly one further label (www.example.com), not example.com itself and not a.b.example.com. When a certificate lists subject alternative names, only that list is matched; the common name is used for certificates that have no such list. Every name in the list is shown, however many there are.
Dates come from the certificate. Days remaining counts whole days and goes negative once the certificate has expired; a certificate that is still valid but expires in fewer than 30 days is reported as a warning, not an error.
The endpoint’s certificates are checked against the CA store this server uses: a path from the presented certificate to a trusted root has to be buildable. The negative outcomes are told apart — the endpoint sent no intermediate linking the certificate to a root (incomplete chain), the certificate is its own issuer (self-signed), the chain ends at a root this store does not hold, or a path was built and rejected.
An incomplete chain is reported as a warning rather than a failure, because browsers keep intermediates in a cache and some fetch the missing certificate from the issuer. This check does neither. It also does not read the trust store of the visitor’s browser or operating system, and it does not check OCSP or CRL revocation or certificate transparency, so a trusted result here is not a promise about the browser on the visitor’s machine.
Only public hosts on port 443 are reachable from this server, private and reserved addresses are blocked, and the name is resolved here — a geo-balanced endpoint can present a different certificate to this server than it serves elsewhere.
The protocol shown is the one this server negotiated, and its TLS stack stops at TLS 1.2: a site that serves TLS 1.3 to current browsers can be reported as TLS 1.2 here. Compare with openssl s_client on a current machine before drawing conclusions. Handshake time is a single measurement from one vantage point, not a benchmark.
Chain length is the number of certificates the endpoint sent, the leaf included — sha256.badssl.com sends three: leaf, intermediate and cross-signed root.