Quick answer
Enter a domain (for example example.com) and press “Check SSL”: the tool connects to the site's port 443 and reports who issued the certificate, how many days are left, whether it matches the domain (SAN), whether browsers trust it, whether the server sends the intermediate certificates, plus the TLS version, cipher, key type and SHA-256 fingerprint.
What is an SSL certificate?
An expired or badly installed certificate is the top reason visitors see “Your connection is not private” and leave. This checker connects from the Công Cụ Nhanh server the way a fresh browser would on its first visit, so it catches problems your own machine may hide (because it already cached the intermediates). Use it after installing or renewing SSL on your hosting, cPanel or Cloudflare, or as a regular check before the expiry date.
How to check an SSL certificate
- 1
Type the domain; pasting a full URL like https://www.example.com/page works too, the tool takes the host part.
- 2
Press “Check SSL”. The Công Cụ Nhanh server connects to port 443 of the domain, usually within 1–3 seconds.
- 3
Read the status box: green is valid, amber is expiring (30 days or fewer), red is expired, name mismatch or untrusted.
- 4
Check the details: names on the certificate (SAN), issuer, expiry, TLS version, key and fingerprint.
- 5
Scroll to “Chain sent by the server” to confirm intermediates follow the domain certificate.
Results and what to do
| Status | Meaning | What to do |
|---|---|---|
| Certificate is valid | Trusted, matches, more than 30 days left | Nothing; enable auto-renewal if you haven't |
| Expiring soon | 30 days or fewer left | Renew, or check your auto-renew job (certbot, acme.sh) is running |
| Expired | The expiry date has passed | Renew and reinstall, then reload the web server |
| Domain mismatch | The domain is not in the SAN list | Reissue covering both the www and bare domain |
| Not trusted by browsers | Self-signed or missing intermediates | Install the fullchain file instead of just the cert, or use a trusted CA |
TLS versions
| Version | Status | Notes |
|---|---|---|
| TLS 1.3 | Recommended | Faster one-round-trip handshake, only strong ciphers (RFC 8446) |
| TLS 1.2 | Still acceptable | Configure ECDHE with AES-GCM / ChaCha20 |
| TLS 1.1, 1.0 | Deprecated | RFC 8996 (2021); modern browsers refuse them |
| SSL 3.0, 2.0 | Insecure | Prohibited for years (POODLE and others) |
Worked examples
Works for me, fails for customers
The result says “Not trusted by browsers” and the chain section lists only one certificate. On Nginx, point ssl_certificate at fullchain.pem instead of cert.pem and reload.
www fails, bare domain works
Checking www.example.com reports “Domain mismatch” and the SAN only lists example.com. Reissue the certificate for both example.com and www.example.com.
Checking before expiry
A one-year paid certificate has 12 days left: status “Expiring soon”. Renew with the vendor and install the new certificate before the date on the Expires row.
After enabling Cloudflare
The issuer now shows Google Trust Services or Let's Encrypt via Cloudflare: that is Cloudflare's edge certificate, not the one on your origin server.
Common problems
- Connection failed, timed out or was refused on port 443.
- HTTPS isn't enabled, a firewall blocks 443, or the domain points to the wrong IP. Check the A record with the DNS Lookup tool.
- Renewed, but the old expiry date still shows.
- The web server hasn't loaded the new certificate: reload Nginx / Apache (or apply in your panel) and check again.
- Using a *.example.com wildcard for example.com.
- A wildcard covers exactly one label (www.example.com, shop.example.com), not example.com itself or a.b.example.com. Add example.com to the SAN.
- Can't check an IP or internal hostname.
- For safety the tool only checks public domains resolving to public IPs; internal addresses, localhost and .local are blocked.
What intermediate certificates are and why they go missing
Certificate authorities don't sign your certificate directly with their root but through one or more intermediates. The server must send those intermediates so the browser can build a path to a root it already trusts.
Many desktop browsers fetch or cache intermediates and still connect, but phones, apps and command-line clients (curl, APIs) will fail. This checker never fills in missing intermediates, so it shows the worst case.
Certificate lifetimes are getting shorter
The CA/Browser Forum approved a schedule shortening the maximum lifetime of public certificates: 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Let's Encrypt issues 90-day certificates. Automated renewal (ACME) is the way to go rather than renewing by hand once a year.
What is checked, and how it stays safe
The Công Cụ Nhanh server resolves the domain, connects only if every IP is public, then performs a TLS handshake to that exact vetted IP on port 443 with the domain sent as SNI. It sends no HTTP request, reads no page content and doesn't store the domains you check.
Glossary
- SAN
- Subject Alternative Name: the list of domains the certificate is valid for; browsers only look at this list.
- CA
- Certificate Authority, an organisation browsers trust to issue certificates (Let's Encrypt, DigiCert, Sectigo…).
- Intermediate certificate
- A certificate linking yours to the CA's root certificate.
- SNI
- Server Name Indication: the domain sent during the TLS handshake so a server hosting many sites picks the right certificate.
- SHA-256 fingerprint
- A hash of the certificate, used to tell whether two certificates are identical.
- Self-signed
- A certificate signed by itself rather than a CA, so browsers don't trust it.
Frequently asked questions
How do I see how many days my SSL certificate has left?
Enter the domain and press “Check SSL”: the status box shows “N days left” with the exact expiry date and time.
My browser connects fine, so why does the tool say not trusted?
Usually missing intermediates: your browser cached them and hides the error, but other devices and phones will fail. Install the fullchain file.
Can it check ports other than 443?
No. To avoid being used for port scanning, it only connects to port 443 of public domains.
Are the domains I check stored?
No. The server only counts requests per IP for a few minutes to prevent abuse; it stores no domains or results.
Is a free Let's Encrypt certificate less secure than a paid one?
The encryption is the same. Paid OV / EV certificates add verification of the organisation; modern browsers show the same padlock.
Is TLS 1.0 / 1.1 still OK?
No. RFC 8996 formally deprecated them and major browsers dropped support. The tool flags servers that only negotiate a legacy protocol.
Ratings and comments
Loading…