What does the SSL certificate inspector show?
Type a domain (or hostname:port), click Check, and the tool opens a real TLS handshake to that server and reads back its certificate chain. You get the same data your browser sees when you click the padlock, plus a few extras: days until expiry, public key strength, signature algorithm, SHA-1 / SHA-256 fingerprints, SANs, AIA and CRL URLs.
Useful when HTTPS broke ("ERR_CERT_DATE_INVALID", "NET::ERR_CERT_AUTHORITY_INVALID"), when you're about to renew a cert and want to confirm the new one is live, or when you're auditing a freshly deployed service and need proof the chain is complete.
Works on port 443 by default, but also 465 (SMTPS), 993 (IMAPS), 8443 (admin panels), any port speaking TLS.
How to use it
- Type a hostname like `example.com` or `mail.google.com`. Skip the https://, that's the protocol, not part of the name.
- Need a non-standard port? Type it after a colon: `example.com:8443`, or fill the dedicated Port field.
- Click Check. Our server opens a TLS handshake, 1-3 seconds on a typical link.
- Read the chain top-down: leaf (your domain) → intermediate (issued by a root) → root CA (DigiCert, Let's Encrypt, etc.). Warnings show in red chips at the top.
When this is useful
Six everyday situations:
- HTTPS broke in the browser. The padlock disappeared or you got "NET::ERR_CERT_*". The inspector tells you which check failed: expired, hostname mismatch, missing intermediate, weak signature.
- Cert renewal. You just deployed a new Let's Encrypt / DigiCert cert. Verify the chain is complete and the validity window starts now.
- Mail server audit. Check SMTPS (465), IMAPS (993), Submission (587) - mail clients are stricter than browsers about chains.
- Internal services. admin.yourdomain.com:8443, vpn.yourdomain.com:443, api.yourdomain.com. Confirm none of them is days from expiring.
- Vendor / third-party check. Before integrating a partner API, eyeball their cert: trusted issuer, valid SAN, no SHA-1.
- Migration. You moved a site to a new host. Confirm the new server presents the right cert (not the old one, not the host's default cert). Also recheck DNS in the DNS lookup and ownership in the WHOIS lookup. For a fresh CSR before reissuing the cert, use the CSR generator.
Questions and answers
Same idea, no terminal. openssl s_client -connect host:443 -showcerts is the gold standard, but the output is dense and you have to parse it yourself. This tool runs the same TLS handshake from our server and pretty-prints the result. Hostname checks, expiry, signature, key strength, SANs, AIA, CRL are all surfaced as ready-to-read chips and rows.