SSL Checker Online

Check the SSL/TLS certificate of any domain: days to expiry, issuer, SANs, hostname match, chain, OCSP stapling, TLS version, cipher and old protocols.

Result

Press “Run” to see the result.

Give a host (domain or IP, optional :port) and the API opens a TLS connection from our edge and reads the certificates the server presents. It returns the leaf certificate (subject, issuer, serial, validity dates and days_remaining, SANs, key type and size, signature algorithm, DV / OV / EV level, key usages, OCSP / CA issuer / CRL URLs, SHA-256 and SHA-1 fingerprints), the chain with each signature checked against the next certificate, the negotiated TLS version, cipher suite, key exchange group and ALPN, and the stapled OCSP status (good / revoked) when the server sends one. With protocols (on by default for one host) it also tests whether TLS 1.0, 1.1, 1.2 and 1.3 are accepted.

A summary says whether the certificate is valid for the name, and warnings lists problems in plain codes: expired, expires_soon (within warn_days, default 30), hostname_mismatch, self_signed, incomplete_chain (an intermediate the server does not send, detected by fetching the issuer from the AIA URL), weak_signature_algorithm, weak_key, legacy_protocol_enabled, revoked. A normal certificate-validating HTTPS request is made as well (https_request), which reflects trust in the usual root stores. hosts checks up to 10 domains at once and returns a short summary per domain.

Honest limits: our edge runs on Cloudflare Workers, which cannot open raw connections to Cloudflare IP ranges. For sites behind Cloudflare (and when the connection times out) the response says source: "certificate_transparency": the certificates listed are the currently valid ones published in Certificate Transparency logs (Cert Spotter, crt.sh) for that name, not necessarily the one served, plus the live HTTPS check. Allowed ports: 443, 8443 and the usual implicit-TLS ports (465, 993, 995, 636…); private and internal addresses are refused.

Use this in your code

curl "https://apibox.io.vn/v1/ssl-check?host=github.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/ssl-check?host=github.com', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/ssl-check?host=github.com",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/ssl-check?host=github.com');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Why does a site behind Cloudflare show certificate_transparency?

Cloudflare Workers cannot open TCP sockets to Cloudflare IP addresses, so the handshake is impossible there. The API then lists the valid certificates logged for the name in CT logs and confirms with a live HTTPS request.

Does "valid" mean browsers trust the certificate?

It means the certificate is in its validity period, matches the host name, is not self-signed, its chain signatures are correct and no missing intermediate was found. Root store trust is reflected by https_request.

Can I check mail or other TLS ports?

Yes for implicit TLS ports such as 465, 993, 995, 636 and 8443. STARTTLS (25, 587, 143) is not supported.