Send the hostname
Server Name Indication is used so shared HTTPS infrastructure can select the intended certificate.
Direct answer: An SSL certificate check reports the certificate presented by a public host, including subject, issuer, covered names, validity dates and negotiated cipher for this connection.
The server resolves the public hostname and opens a bounded TLS connection on port 443 to read the presented certificate. Result responses are private, uncached and excluded from search indexing. Do not enter passwords or secrets. Read the lookup privacy policy.
What this ssl certificate check tells you
The certificate check opens a TLS connection to a public hostname and reports the peer certificate's names, issuer and validity window. It inspects one endpoint from one network path; it does not audit the full TLS configuration or application.
- Which certificate this probe received for the hostname
- Whether the hostname and current time fit the certificate presented
- The subject alternative names, issuer and validity dates
Certificate validity is only one dependency in the website monitoring methodology, alongside DNS, connection, HTTP and application checks.
How the evidence is collected
Build trust
The client validates the chain against its trust store and checks the hostname unless a diagnostic error prevents completion.
Record the leaf
Names and dates describe the presented leaf certificate; other regions or edges can temporarily present different certificates.
Read the fields without overclaiming
| Signal | What it can establish | What it does not prove |
|---|---|---|
| SAN | The DNS names or IP addresses covered by the certificate. | Ownership of each site or service. |
| Issuer | The certificate authority named in the certificate chain. | A recommendation of the website. |
| Not before / after | The certificate's validity window. | Guaranteed service availability for that period. |
| Chain validation | A path to a trusted root under this client's policy. | That every client has the same trust store. |
Certificate is valid but the hostname is absent from SAN
The cryptographic certificate can be within its date window yet wrong for the requested host. Confirm the exact hostname, CDN or load-balancer binding, and renewal deployment. Do not rely on the legacy common name when SAN is present.
Common mistakes
- Equating a valid certificate with a trustworthy website
- Checking only expiration and not hostname
- Ignoring SNI on shared hosts
- Assuming every CDN edge has already received the same renewal
SSL Certificate Check FAQ
How early should a certificate be renewed?
Renew with enough time to deploy and verify across all endpoints; operational lead time matters more than waiting for a fixed last day.
Does TLS hide the destination hostname?
TLS encrypts application data, but ordinary DNS and aspects of connection setup can still expose destination information depending on the protocol configuration.
What is a wildcard certificate?
A wildcard such as *.example.com covers one label at that level under certificate matching rules, not the apex or arbitrary deeper names.
Explore more ssl certificate check and domain research questions