SSL Certificate Checker

We open a real TLS handshake to the host on port 443, fetch the certificate chain it presents, and validate it against Node’s root trust store. We report the protocol version, cipher, expiry date, hostname match, key strength, signature algorithm, and the full chain.

Transport Layer Security (TLS) & X.509 Public Key Infrastructure

Transport Layer Security (TLS)—the modern cryptographic successor to SSL—secures network communications over HTTPS by authenticating server identity and establishing symmetric encryption keys. Without valid TLS parameters, browsers abort connection requests with blocking security warnings.

The X.509 Certificate Chain Architecture

Certificate validation relies on a hierarchical trust model defined by standard RFC 5280:

  • Leaf (End-Entity) Certificate: Issued directly to your domain hostname. Contains the public key, Subject Alternative Names (SANs), validity timestamp window, and digital signature from an intermediate CA.
  • Intermediate Certificate Authority (ICA): Signs leaf certificates on behalf of the root CA. Isolates the offline root key from routine operational exposure. Web servers must serve the intermediate bundle alongside the leaf certificate.
  • Root Certificate Authority: Self-signed anchor hardcoded in browser and operating system trust stores (Mozilla NSS, Apple, Windows).

Subject Alternative Names (SANs) & Hostname Matching

Modern browsers strictly validate the Subject Alternative Name (SAN) extension rather than legacy Common Name (CN) attributes.

  • Wildcard Coverage: A certificate for *.example.com validates first-level subdomains (e.g. api.example.com, blog.example.com), but does NOT cover the root apex domain (example.com) or nested subdomains (dev.api.example.com) unless explicitly listed.
  • Apex & Subdomain Binding: Production certificates should list both the apex domain (example.com) and the www variant (www.example.com) in the SAN extension.

Recommended Security Hardening Directives

1. HTTP Strict Transport Security (HSTS)

Prevent SSL stripping attacks by transmitting the Strict-Transport-Security response header:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

2. Certificate Authority Authorization (CAA) DNS Records

Restrict which Certificate Authorities are authorized to issue certificates for your domain by publishing a CAA DNS record:

example.com. IN CAA 0 issue "letsencrypt.org"

Frequently Asked Questions

What is the difference between TLS 1.2 and TLS 1.3?

TLS 1.3 simplifies the cryptographic handshake from two round trips (2-RTT) to one round trip (1-RTT), removes obsolete ciphers (such as RC4, 3DES, and CBC-mode AES), and mandates Forward Secrecy across all cipher suites.

Why does my certificate show an “Untrusted Chain” error?

This almost always occurs when the web server configuration is missing intermediate CA certificates in the SSL bundle. Desktop browsers may cache intermediates locally, but mobile browsers and search crawlers will throw immediate trust validation errors.

How does HTTPS affect search rankings?

Google uses HTTPS as a baseline ranking signal. Unencrypted HTTP pages display “Not Secure” warnings in modern browsers and are disqualified from many modern web platform features (Service Workers, Geolocation). Verify your HTTP response codes using our HTTP Status Checker.