How it works
The analyzer connects to the service you specify and examines the SSL/TLS certificate it presents: issuer, subject, validity dates, subject alternative names (SAN), signature and key algorithms, and the chain of trust up to the root authority.
With that information you can spot at a glance an expired or soon-to-expire certificate, a domain not among the covered names, an unexpected issuer, or an incomplete chain that breaks trust in some clients.
Use cases
- Verify when a certificate expires and anticipate its renewal.
- Confirm that the queried domain is among the certificate's SANs.
- Diagnose trust errors by checking whether an intermediate certificate is missing from the chain.
- Check the issuer and signature algorithm after installing or migrating a certificate.
Frequently asked questions
What is the chain of trust?
It is the sequence that goes from the server's certificate to one or more intermediate certificates and ends at a root authority the system trusts. If an intermediate link is missing, many clients reject the connection even if the certificate is valid.
What are SANs?
The Subject Alternative Names are the list of domains and names the certificate covers. The browser validates the site's name against this list, not against the Common Name field, so the domain you visit must appear here.
Why does a valid certificate give an error in the browser?
The most common causes are an incomplete chain (a missing intermediate), the domain not being among the SANs, the certificate having already expired, or the client's clock being off. The analysis helps identify which of these cases applies.
Does the tool also validate the protocols and ciphers?
It shows the details of the certificate and the negotiated connection. To review in depth the accepted TLS versions and cipher suites, it is best to complement it with the server's configuration.