Free SSL Certificate & TLS Checker
Verify SSL expiration dates, inspect root and intermediate CA chains, test negotiated cipher suites, and debug handshake errors in real time.
uptara.co
✅ Valid SSL/TLS Certificate Chain
Grade A+ • Hardened & Modern (TLS 1.3)
uptara.co
Let's Encrypt Authority E6
74 Days Remaining
TLSv1.3 • TLS_AES_256_GCM_SHA384
Interactive Certificate Hierarchy (Chain of Trust)
ISRG Root X1
Root Certificate Authority (Trust Anchor)
Let's Encrypt Authority E6
Intermediate Certificate Authority
uptara.co
End-Entity Server Certificate
TLS_AES_256_GCM_SHA384
74 Days Remaining
How the Free SSL Checker Works
Our SSL and TLS checker performs a real-time, non-intrusive cryptographic inspection of your target server directly from high-performance edge nodes.
DNS & TCP Connect
Resolves IPv4/IPv6 address records for the target host and opens a secure TCP socket to destination port 443.
TLS Handshake & SNI
Sends a ClientHello including Server Name Indication (SNI) to request the exact virtual host certificate from multi-tenant servers.
X.509 Chain Retrieval
Downloads the leaf server certificate and intermediate CA bundles returned by the web server during the handshake.
Cryptographic Audit
Calculates remaining days, validates Root CA signatures against operating system trust stores, and inspects negotiated ciphers.
What This Tool Checks
Every SSL inspection audits six core cryptographic parameters to ensure your endpoint is secure, compliant, and free from browser interstitial warnings.
SSL Certificate Expiry
Validates the notBefore and notAfter timestamps and calculates remaining runway days before browser security interstitials lock out visitors.
Certificate Chain
Traces the 3-tier WebPKI path from your Leaf certificate through Intermediate CAs to the Root CA anchor, identifying missing bundles that break mobile browsers.
Issuer Authority
Identifies the signing Certificate Authority (e.g. Let’s Encrypt, DigiCert, Sectigo, Cloudflare) and validates root store trust anchor status across Mozilla and Microsoft.
Subject Alternative Names (SANs)
Extracts all covered hostnames, API endpoints, and wildcards to prevent SSL_ERROR_BAD_CERT_DOMAIN errors across subdomains.
TLS Protocol Version
Tests for modern TLS 1.3 and TLS 1.2 support while verifying that obsolete, vulnerable protocols (SSL 3.0, TLS 1.0, and TLS 1.1) are disabled.
Cipher Suite
Inspects symmetric encryption algorithms (AES-GCM, ChaCha20-Poly1305) and Perfect Forward Secrecy (ECDHE) to protect against eavesdropping and decryption.
Understanding the 3-Tier Certificate Chain of Trust
Embedded in operating systems (Apple, Windows, Android, Linux). Kept permanently offline in high-security vaults to prevent root key compromise.
Signed by the Root CA to handle daily issuance. Servers must bundle this certificate to bridge trust between the browser’s trust store and the site.
Issued to your specific domain. Contains your public key and Subject Alternative Names (SANs), proving server identity during TLS handshakes.
Modern TLS Cipher Suites & Security Ratings
| Security Status | Cipher Suite Name | Protocol | Recommended Use Case |
|---|---|---|---|
| Secure | TLS_AES_256_GCM_SHA384 | TLS 1.3 | High-security modern web traffic (Default in HTTP/3 & TLS 1.3) |
| Secure | TLS_CHACHA20_POLY1305_SHA256 | TLS 1.3 | Mobile & ARM devices lacking hardware AES acceleration |
| Secure | ECDHE-ECDSA-AES128-GCM-SHA256 | TLS 1.2 | High-performance legacy compatibility with Perfect Forward Secrecy |
| Weak | ECDHE-RSA-AES256-SHA384 | TLS 1.2 | CBC-mode cipher. Vulnerable to padding oracle timing attacks if unpatched. |
| Insecure | DES-CBC3-SHA / RC4-MD5 | SSL 3.0 / TLS 1.0 | Prohibited by PCI-DSS, NIST, and HIPAA. Deprecated 64-bit blocks. |
Common SSL/TLS Errors and How to Resolve Them
Encountering a certificate error during inspection? Here are the most frequent production SSL issues and their exact configuration fixes.
1. "SEC_ERROR_UNKNOWN_ISSUER" or Incomplete Certificate Chain
Critical ErrorCause: Your web server is only providing the leaf certificate without the intermediate CA certificate. Desktop Chrome may cache the intermediate cert, but mobile browsers and curl will fail with SSL handshake errors.
How to Fix in Nginx:
# Combine server cert and intermediate cert into fullchain.pem:
cat your_cert.crt intermediate.crt > /etc/ssl/certs/fullchain.pem
# In your nginx.conf:
ssl_certificate /etc/ssl/certs/fullchain.pem;
ssl_certificate_key /etc/ssl/private/privkey.pem;
2. "NET::ERR_CERT_DATE_INVALID" or Certificate Expired
Outage BlockerCause: The certificate validity timestamp (notAfter) has passed. All modern browsers immediately block visitor access with red security interstitial warnings.
How to Fix with Certbot (Let's Encrypt):
# Force renewal immediately:
sudo certbot renew --force-renewal
# Verify renewal cron timer:
sudo systemctl status certbot.timer
# Reload web server:
sudo systemctl reload nginx # or apache2
3. "SSL_ERROR_BAD_CERT_DOMAIN" or Common Name Mismatch
Domain MismatchCause: The host requested by the client does not match any DNS entries in the certificate’s Subject Alternative Names (SANs) list. For example, requests to subdomain.example.com using a certificate issued strictly for example.com.
How to Fix: Reissue the certificate specifying all required hostnames as SANs or request a wildcard certificate (e.g. *.example.com) to cover all subdomains.
4. "ERR_SSL_VERSION_OR_CIPHER_MISMATCH"
Protocol ErrorCause: Server requires obsolete SSLv3 or insecure ciphers disabled by modern browsers, or server does not support Server Name Indication (SNI).
Recommended Nginx TLS Configuration:
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
How to Check SSL Manually with OpenSSL & CLI
To inspect an SSL certificate directly from your command line without a browser, query port 443 on the remote host using openssl s_client or curl.
echo | openssl s_client -servername uptara.co -connect uptara.co:443 2>/dev/null | openssl x509 -noout -datesopenssl s_client -showcerts -servername uptara.co -connect uptara.co:443 < /dev/nullcurl -Iv https://uptara.co 2>&1 | grep -iE "expire|SSL connection"Automated SSL Monitoring with Uptara
Manual command-line checks are useful for immediate debugging, but production workloads require continuous, automated vigilance. Automated renewal bots (such as Certbot) frequently fail due to DNS modifications, firewall rules, or expired API keys.
Uptara continuously verifies certificate health from multiple worldwide edge regions every 30 seconds, catching localized TLS routing failures.
Automated escalation alerts are triggered at 30, 14, 7, and 1 day before expiration, providing your engineers ample time to renew.
Receive instant notifications directly to WhatsApp, Slack, Discord, Microsoft Teams, and custom webhooks before customers encounter downtime.
Need to monitor client certificates and mutual TLS authentication? See Uptara's mTLS monitoring for zero-trust microservices and banking APIs.
Frequently Asked Questions About SSL, TLS & PKI Chains
Everything you need to know about certificate expiration, chain of trust, and automated monitoring.
The Uptara SSL Checker establishes an encrypted TLS handshake directly with your target domain using modern cryptographic client engines. It retrieves the X.509 certificate chain, verifies digital signatures against trusted root certificate authorities, evaluates cipher suite negotiation, checks Subject Alternative Names (SANs), and calculates exact expiration runway.
You can check your SSL expiration date from any terminal using OpenSSL by running: echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates. This outputs notBefore and notAfter timestamps without needing to install external tools.
An SSL certificate chain connects your server certificate to a trusted Root CA through one or more intermediate certificates. If your web server does not bundle the intermediate certificate (known as an incomplete chain), web browsers like Firefox and mobile devices will reject the connection with SEC_ERROR_UNKNOWN_ISSUER.
To fix an incomplete chain in Nginx, configure ssl_certificate to point to fullchain.pem (which concatenates your server certificate and the intermediate CA certificate) rather than cert.pem. In Apache 2.4.8+, point SSLCertificateFile to fullchain.pem. In older Apache releases, specify SSLCertificateChainFile /path/to/chain.pem.
SSL (Secure Sockets Layer) is the obsolete predecessor to TLS (Transport Layer Security). Modern security mandates TLS 1.2 or TLS 1.3. TLS 1.3 reduces handshake latency to 1 round-trip time (1-RTT), enhances forward secrecy, and eliminates insecure legacy ciphers like RC4, 3DES, and CBC-mode ciphers.
A Common Name Mismatch (SSL_ERROR_BAD_CERT_DOMAIN) happens when the domain in your browser URL bar does not match any name listed in the certificate Common Name (CN) or Subject Alternative Name (SAN) fields. For instance, accessing www.example.com when the certificate only covers example.com.
Production systems should be monitored continuously 24/7. Modern automated certificates (like Let’s Encrypt) renew every 60–90 days, and ACME automated renewal scripts frequently fail due to DNS changes, firewall blocks, or expired API tokens. Continuous monitoring alerts you weeks in advance.
You can create a free HTTP monitor on Uptara in 30 seconds. Uptara checks your SSL/TLS certificates around the clock from global edge locations and automatically dispatches escalation alerts to WhatsApp, Slack, and webhooks at 30, 14, 7, and 1 day before expiration.
API Reliability & Monitoring Ecosystem
Explore connected platform capabilities, in-depth engineering guides, and interactive developer utilities.
Related Capabilities
SSL Certificate Monitoring
Automated 24/7 SSL certificate expiry tracking, TLS handshake validation, and HTTP/HTTPS uptime monitoring.
mTLS Monitoring
Bilateral cryptographic authentication for zero-trust microservices and banking APIs.
API Uptime
High-precision active health checks every 10–30 seconds with automated multi-region verification.
Recommended Guides
What is Mutual TLS?
Cryptographic breakdown of bidirectional TLS handshakes, CA hierarchies, and synthetic mTLS mechanics.
How to Monitor an API
Step-by-step developer tutorial on setting up automated HTTP health checks with cURL, Python, and Node.js.
10 Monitoring Best Practices
Production checklist for microservices: status code assertions, zero-trust mTLS verification, and escalation.
Never Let An Expired Certificate Take Down Your App
Automate 24/7 multi-region SSL expiry checks with instant WhatsApp, Slack, and webhook alerts before your customers notice.