TLS Cert Inspector connects to a host over HTTPS and inspects the TLS certificate that the server presents: subject and issuer, validity period, key and signature algorithm, subject alternative names (SANs), supported TLS versions, certificate transparency status, and security warnings.
Enter a host name in the Target field, for example example.com, and press Inspect or the Enter key. A protocol prefix (https://), a path and a trailing dot are removed automatically. The host is checked on port 443 with its canonical, lower-case name.
The Certificate section shows the subject (common name and organisation), the issuer, the validity period (valid from / expires) with the days left, the public key type and size, the signature algorithm with its hash, the serial number and the number of certificates in the presented chain.
Modern certificates list the host names they are valid for as subject alternative names. The SAN section shows them all, including wildcard entries such as *.example.com.
The TLS versions section probes which versions the server actually supports: TLS 1.3, 1.2, 1.1 and 1.0. A green check mark means the server offers that version. Deprecated versions (TLS 1.0 and 1.1) are a security risk and are flagged in the warnings.
The Warnings section evaluates the certificate expiration, the host name match (does the certificate cover the requested host, including wildcards), weak algorithms (SHA-1/MD5 signatures or keys below 2048 bit RSA / 224 bit ECDSA), chain completeness, deprecated TLS versions and certificate transparency. Each finding has a status PASS, WARN, FAIL or INFO.
The TLS handshake is performed by this server. For the certificate transparency check, the host name is queried against the public Cert Spotter API. Your browser only sends the host name to this server; the server performs the inspection and returns a result. No personal data is stored. Results are cached on the server for a few minutes.