SSL Certificate Checker

SSL Certificate Checker opens a TLS handshake from the OmniKitly service to the host you name, with SNI set to that name so a shared address hands back the right certificate, and turns what came back into a report. The certificate table gives subject and issuer, the valid-from and valid-to dates, days remaining, serial, key type and size, the negotiated protocol and cipher suite, the SHA-256 fingerprint, and the verification verdict. Below it sit the subject alternative names, with the one matching the host you asked about marked; the chain as it was presented; the OCSP stapling result; and a findings list that names each problem in order of severity. The raw JSON behind all of it downloads as a file named after the host.

The handshake is made deliberately without enforcing verification, which is what makes this useful on a host that is already broken: an expired certificate, a self-signed one, a name that is not on the certificate, or a chain served without its intermediate all still produce a full report rather than a bare connection error, with the verdict recorded as an error code beside it. That verdict is reached against the certificate authorities bundled with the service's runtime, so it describes what an outsider sees rather than what your own machine sees — a certificate signed by a private or corporate root that your laptop trusts reads as untrusted here, and that difference is frequently the answer you came for.

Each of the four settings changes the run. Validate the full chain walks from the leaf to whatever signed it and lists every certificate on the way, with its key and its own expiry date, and calls out the faults that matter: a leaf served with no intermediate beside it, a chain that stops before it reaches a self-signed root, an intermediate that expired years ago, an RSA key under 2048 bits. Report OCSP stapling asks for a stapled response during the handshake and decodes the one that comes back — responder status, certificate status, when it was produced and when it goes stale. Warn when expiring within sets the threshold at which a valid certificate is reported as expiring soon, anywhere from 1 to 365 days. Port is used when the address carries no port of its own; write example.com:8443 and the port in the address wins.

No file is involved in this job. The hostname you type travels to the processing service over an encrypted connection as a job setting, the handshake is made from that machine, and the job record and the JSON report are deleted together six hours after the run by default. Two timing limits sit behind it: the handshake is abandoned after ten seconds and the job after twenty. The connection is also implicit TLS from the first byte, so ports that begin in plaintext and upgrade through STARTTLS — submission on 587, SMTP on 25, IMAP on 143 — never reach a certificate here, while ports that are TLS from the start, such as 8443, 993 or 465, behave exactly as 443 does.

Secure server processing. This operation requires temporary server processing.