AltF DomainOps

SSL certificate check: expiry, chain and hostnames

Enter a hostname and DomainOps opens a real TLS connection to it on port 443, reads the certificate the server presents, and tells you whether it is trusted, whether it covers that hostname, who issued it and how many days are left. It also lists every name in the certificate and the chain up to the root.

  • Free, no sign-up
  • Real DNS, RDAP and TLS data
  • Raw records shown
  • No affiliate links
Check a domain

What each result means

  • Trust: the chain leads to a root that browsers trust. A missing intermediate is the most common failure.
  • Hostname: the name you typed is in the certificate's subject alternative names (wildcards count for one level).
  • Expiry: days until the not-after date. Public certificates last at most 398 days, and the limit is shrinking.
  • Protocol: the TLS version negotiated. TLS 1.2 and 1.3 are current; anything older fails.

Fixing common certificate errors

  • Expired: renew it and check the auto-renewal job (Certbot, your host's panel or your CDN).
  • Name mismatch: reissue with both example.com and www.example.com, or redirect one before TLS.
  • Untrusted chain: install the intermediate bundle your authority provides alongside the certificate.
  • Issuance blocked: a CAA record may not list your authority. Check it on the CAA record check page.

Have a certificate file instead?

To decode a PEM certificate you have on disk without connecting anywhere, use the SSL certificate inspector tool. To grade the site's security headers, use the website security check in AltF Security.

SSL certificate check: questions and answers

How do I check when an SSL certificate expires?

Enter the hostname in the SSL tab. The result shows the expiry date and the number of days left, read live from the server's certificate. Add the domain to the watchlist to keep a countdown.

Why does the checker say trusted when my browser shows an error?

Check you tested the same hostname (www and the bare domain can serve different certificates), and that your browser is not behind a proxy or antivirus that replaces certificates. Clock errors on the device also cause browser warnings.

Does it check every server behind a load balancer?

It connects to the first public IP the hostname resolves to. If servers behind the name have different certificates, repeat the check later or test each IP's hostname.

Focused checks and guides

Checks

Full domain health checkAll nine tools, the record glossary and how each check works.DNS lookupFree DNS lookup for A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, DS, DNSKEY and HTTPS records, with TTLs, DNSSEC status and what each record means.MX lookupFree MX record lookup: see a domain's mail servers in priority order, which email provider runs them, and whether SPF and DMARC are set.NS lookupFree nameserver lookup: see which nameservers answer for a domain, who the DNS host is, the SOA serial, and whether the zone is DNSSEC-signed.TXT record lookupFree TXT record lookup that labels each record: SPF, Google and Microsoft verification, Meta, Apple, Stripe and 25 more services, plus DMARC and DKIM.Domain expiry checkCheck when a domain expires from the registry's own RDAP data: expiry date, days left, registrar, transfer lock and status codes in plain English.Reverse DNS lookupFree reverse DNS lookup for IPv4 and IPv6: find the PTR hostname of an IP address and the network owner from the regional internet registry.DNSSEC checkCheck whether a domain uses DNSSEC: DS record at the registry, DNSKEY in the zone and whether public resolvers validate the answers.CAA record checkLook up a domain's CAA records to see which certificate authorities may issue certificates, including wildcard and reporting rules, with fixes.

Guides

Domain launch checklistA 20-point checklist to launch a new domain: DNS records, www, HTTPS, email authentication, DNSSEC, CAA, registrar lock, with a free check for each step.Website migration DNS checklistMove a website or DNS to a new host without downtime: lower TTLs, copy records, switch nameservers, watch resolvers, handle DNSSEC and email.Email domain setup guideSet up email for your domain the right way: MX records, one SPF record under 10 lookups, DKIM keys, a DMARC rollout plan, MTA-STS and BIMI.

25 more free domain and DNS tools

Single-purpose AltFTool tools for one job each, grouped by what you are trying to do.

Lookups

One question, one answer.

Write records

Generate correct records before you paste them into your DNS host.

Certificates and HTTPS

Go deeper than the live certificate check.

See all 25 tools

AltFTool does not store the domains or addresses you check. DNS lookups in the DNS, compare, email and IP tools run from your browser; registration, report and certificate checks pass through AltFTool's server and keep nothing.