SSL/TLS certificate checker
Enter a hostname to see its SSL/TLS certificate details: who issued it, what names it covers, and when it expires.
How to use the ssl/tls certificate checker
- Enter a hostname.
- Press Check.
- Read the issuer, coverage, and days until the certificate expires.
Reading a certificate
This connects to the host on port 443, reads the certificate the server presents, and shows who issued it, the names it covers, and when it expires. An expired certificate makes browsers warn or block visitors, so renew before the "valid until" date: Let's Encrypt automates this on a ~90-day cycle. Also check the site's security headers.
Code & API examples
Use this from the command line or your code. The API is free, GET-only, and returns JSON.
API (curl)
curl "https://vpn.golf/api/tools/ssl?host=example.com"OpenSSL
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -datesSee all endpoints at /api/tools/.
Frequently asked questions
Enter the hostname above: this tool connects to the site, reads its certificate, and shows the exact expiry date and days remaining.
Browsers will warn visitors and may block the site. Certificates must be renewed before their 'valid until' date; Let's Encrypt automates this.
TLS is the modern protocol that replaced SSL; the old name stuck. Every certificate today is really a TLS certificate, and well-configured servers disable SSL entirely in favor of TLS 1.2 and 1.3.
Your server presents its leaf certificate plus intermediate certificates that link it to a trusted root in the browser's store. A missing intermediate causes errors on some clients even when the leaf is valid.
Usually an incomplete chain. Some browsers cache or fetch missing intermediates while others don't, so install the full chain your CA provides rather than just the leaf.
Server Name Indication lets one IP host many certificates by sending the hostname during the handshake. This checker sends SNI, so enter the exact hostname to get the right certificate.
The hostname you connected to isn't listed in the certificate's subject or SAN entries. Reissue the certificate to cover the name, or connect using a name it does cover.
Let's Encrypt certificates last 90 days and should auto-renew around 30 days before expiry. Commercial certificates often run a year. Automate renewal so a forgotten date never takes a site down.
Yes: specify the port (for example a mail server on 993 or 465). The tool connects to that port and reads whatever certificate is presented there, not just 443.
A wildcard like *.example.com secures every direct subdomain with one certificate. It won't cover the bare apex or deeper names like a.b.example.com, which need their own entries.
Yes: vpn.golf has a free GET-only JSON endpoint at /api/tools/ssl that returns issuer and expiry, so you can poll it from a cron job or monitor and alert before a certificate lapses.
No. It only proves the connection is encrypted and the hostname is verified. A phishing site can hold a perfectly valid certificate, so a padlock confirms privacy, not trustworthiness.
Want to hide your IP for real?
vpn.golf is a no-logs WireGuard VPN. Pick a hole, take the shot.
Step up to the tee for free