My certificate works in Chrome but fails in curl. Why?

Almost always a missing intermediate certificate. Browsers cache intermediates from previous visits and can fetch them through the authority information access extension. curl and most language HTTP clients do neither, so the chain has to be complete in what the server sends. Add the intermediate to the server chain file.

What is the difference between SSL and TLS?

SSL is the original protocol from Netscape, obsolete since SSL 3.0 was deprecated in 2015. TLS replaced it. Everything called an SSL certificate today is an X.509 certificate used with TLS. The name persists in product marketing, and this page uses it for that reason.

Does a valid certificate mean a site is safe?

No. It means the connection is encrypted and the server proved control of the hostname. A phishing site can obtain a valid certificate for its own domain in minutes and for free. The certificate authenticates a name, not an intent.

Why do free certificates only last 90 days?

Short lifetimes limit the damage from a compromised key and reduce reliance on revocation, which historically does not work well in browsers. Short lifetimes require automated renewal, which is the point. The industry is moving all public certificates in this direction.

Can I check a certificate on a port other than 443?

Not with this tool. It reads port 443 only. For a mail server on 465 or 993, or anything else, use openssl s_client with the -connect and -starttls options locally.

SSL Certificate Checker

Enter a hostname to read the certificate it presents: names, issuer, chain, validity window, key type and fingerprint.

How the check runs

The hostname is resolved first, and only a public address is ever contacted. A name that resolves into private or reserved space is refused rather than probed, so this tool cannot be pointed at a network behind our edge.

We then open a plain TCP connection to port 443 and send a TLS 1.2 ClientHello carrying the hostname as the server name. The server’s reply contains the certificate chain in the clear, and that is what gets decoded. The handshake is abandoned at that point: no key exchange completes and no application data is ever sent. A server that refuses TLS 1.2 outright returns no certificate here, and the page says so instead of guessing.

A plain HTTPS request runs alongside the probe for the status code, the Strict-Transport-Security header and Alt-Svc. Both go out from our edge, which means a datacenter address rather than your network. If a host serves different certificates by client address or through a WAF policy, what we see may differ from what you see, so the result names the address we connected to.

What this does not check

It is not a protocol audit. It does not enumerate every supported TLS version or cipher suite, it does not test for known protocol weaknesses, and it does not grade the configuration. Those need a dedicated scanner that opens many connections with different parameters, which is a heavier and noisier operation than the single handshake this page makes. Use a purpose-built scanner when you need that.

It also does not check certificate revocation. The OCSP responder URL published inside the certificate is shown, but no revocation lookup is made and stapling is not inspected.

About this tool

We open port 443 and take the chain out of the TLS handshake, then show the subject, every subject alternative name, the issuer and the chain as the server sent it, the validity window with days remaining, the key type and size, the signature algorithm, and the SHA-256 fingerprint. Public hostnames on port 443 only.

How to read the result

Subject and common name: The main identity field on the certificate. Browsers have ignored the common name for hostname matching since 2017 and use the subject alternative names instead, so a CN that matches while the SAN list does not still produces an error.
Subject alternative names (SANs): The full list of hostnames the certificate is valid for, and the authoritative list for hostname verification. A wildcard entry such as *.example.com matches one label only, so it covers a.example.com but not b.a.example.com and not example.com itself.
Issuer and chain: The certificate authority that signed it, plus the intermediates the server presented. A missing intermediate is the classic failure that works in browsers, which cache intermediates or fetch them, and breaks in curl and in mobile applications, which do neither.
Validity window and days remaining: notBefore and notAfter in UTC, and how many days are left. Public certificates are capped at 398 days today, and the CA/Browser Forum has agreed a schedule that cuts that toward 47 days by 2029, so renewal automation stops being optional.
Key type, size, and signature algorithm: The cryptography in use, which today means RSA 2048 or larger, or ECDSA P-256 or P-384, signed with SHA-256 or stronger. Browsers have rejected SHA-1 signatures since 2017, so anything still using one is on a private trust store.
Negotiated TLS version and cipher: The settings of our own probe connection. We offer TLS 1.2 and nothing else, because a TLS 1.3 handshake encrypts the certificate before any client can read it, so this row says nothing about whether the server also speaks TLS 1.3.

Questions people ask

My certificate works in Chrome but fails in curl. Why?: Almost always a missing intermediate certificate. Browsers cache intermediates from previous visits and can fetch them through the authority information access extension. curl and most language HTTP clients do neither, so the chain has to be complete in what the server sends. Add the intermediate to the server chain file.
What is the difference between SSL and TLS?: SSL is the original protocol from Netscape, obsolete since SSL 3.0 was deprecated in 2015. TLS replaced it. Everything called an SSL certificate today is an X.509 certificate used with TLS. The name persists in product marketing, and this page uses it for that reason.
Does a valid certificate mean a site is safe?: No. It means the connection is encrypted and the server proved control of the hostname. A phishing site can obtain a valid certificate for its own domain in minutes and for free. The certificate authenticates a name, not an intent.
Why do free certificates only last 90 days?: Short lifetimes limit the damage from a compromised key and reduce reliance on revocation, which historically does not work well in browsers. Short lifetimes require automated renewal, which is the point. The industry is moving all public certificates in this direction.
Can I check a certificate on a port other than 443?: Not with this tool. It reads port 443 only. For a mail server on 465 or 993, or anything else, use openssl s_client with the -connect and -starttls options locally.

Last reviewed 2026-09-05.