Server
sysadmin.lk

SSL/TLS Certificate Checker

Check a site's certificate, protocol version, cipher, and get an A+ to F grade.

What does the SSL checker test?

Reviewed by Prabath Thalangama · Last updated

The SSL/TLS checker connects to a site on port 443 the way a strict client would, verifies the certificate chain and host name, and reports the certificate's issuer, validity dates, days to expiry and names, plus the negotiated TLS version and cipher. It then grades the setup from A+ to F and explains every deduction.

The check uses full certificate verification, like curl or a Java or Python client. A certificate that browsers accept can still fail here, most often because the server does not send its intermediate certificate: browsers fetch the missing piece themselves, API clients and many mail servers do not.

The grade starts at 100 and loses points for an older negotiated protocol (TLS 1.2 costs 5, TLS 1.1 or older costs 40), a weak cipher (40) and an approaching expiry date (5 under 30 days, 20 under 14). A+ needs a perfect 100; an expired certificate or a failed handshake is an F. The methodology page has the full table.

How do I check a website's SSL certificate?

  1. Enter the host name, for example www.example.com. Check each name your certificate should cover separately.
  2. Read the grade, then any findings, then the certificate details.
  3. Fix the issues on the server or load balancer that terminates TLS, reload it, and check again.

How to read the results

Grade
A+ to F, from the protocol, cipher and expiry checks described above.
Subject and SANs
The names the certificate is valid for. The host you entered must match one of the subject alternative names.
Issuer
The certificate authority that signed it, for example Let's Encrypt or DigiCert.
Valid from / until and days to expiry
The validity window. Since March 2026 public certificates can be valid for at most 200 days, falling to 47 days by 2029 under CA/Browser Forum rules, so automate renewal.
TLS version and cipher
The best protocol and cipher suite the server negotiated with a modern client. TLS 1.3 is ideal.
Handshake time
How long the TCP and TLS handshake took from our server, in milliseconds.

Common SSL/TLS problems and how to fix them

Could not establish a TLS connection

The handshake failed verification or never completed. The usual causes are a missing intermediate certificate, a certificate that does not cover this host name, an expired certificate, or nothing listening with TLS on port 443.

Incomplete certificate chain

Configure the server with the full chain: your certificate followed by the intermediates (Let's Encrypt calls this fullchain.pem). Do not include the root.

# nginx
ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

Certificate expiring soon or expired

Renew it and reload the web server. With Let's Encrypt, check that the certbot or acme.sh timer is running and that its reload hook actually reloads the server.

sudo certbot renew --dry-run
systemctl list-timers | grep -i certbot

Weak protocol or cipher negotiated

Allow only TLS 1.2 and 1.3 and modern AEAD ciphers. Enabling TLS 1.3 is also what moves an A to an A+ here.

# nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

Examples and command-line equivalents

Inspect a certificate with OpenSSL

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

Check the chain the server sends

Look for 'Verify return code: 0 (ok)' at the end, and at least two certificates in the chain.

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null

Test with curl's strict verification

curl -vI https://example.com 2>&1 | grep -E 'SSL connection|expire|subject|issuer'

Frequently asked questions

Why does my site work in Chrome but fail with curl or this checker?

The server is almost certainly not sending its intermediate certificate. Chrome can fetch it via the certificate's AIA extension or a cache; curl, API clients and most programming languages cannot. Serve the full chain.

How do I get an A+?

Serve a valid certificate with a complete chain that has more than 30 days left, negotiate TLS 1.3, and use a strong cipher. TLS 1.3 support is the usual difference between A and A+.

Does this test every protocol the server supports?

No. It grades the protocol and cipher a modern client negotiates, which is what your visitors actually get. It does not enumerate every legacy protocol the server would also accept; use a tool such as testssl.sh for a full protocol and cipher scan.

How often should I check my certificate?

Automate renewal and monitoring rather than checking by hand. A free Domain Monitor here re-runs the checks on a schedule and records the score over time.

Further reading

More Security tools

All Security tools →