Tool 1.6

SSL/TLS certificate checker (expiry, issuer, hostname)

Check any site's SSL/TLS certificate: whether it's valid, when it expires, who issued it, which names it covers and the TLS version in use.

Online checkThe domain goes to our server (api.ethorns.com), which opens a TLS connection to it on port 443 and keeps only the result for 10 minutes.

An automated check; it doesn't guarantee security.

How to use it

Type a domain, for example example.com.
Press Check. Our server (api.ethorns.com) opens one HTTPS connection to it on port 443 and reads the certificate it sends.
Read the verdict and the days left. Red means fix it now; amber means renew soon.

“Your connection is not private” and other signs

Check the certificate when visitors see “Your connection is not private”, when an app or payment gateway suddenly can't connect to your site, or after you renew a certificate, move hosting or add www or a new subdomain. Old domains nobody watches, like a past campaign's site, are worth a look too: an expired certificate there shows visitors the same warning.

The certificate is what lets a browser encrypt the connection and confirm it's talking to the right name. It lists the names it covers, who issued it and the dates between which it's valid.

When a wildcard misses the bare domain

Check tienda-ejemplo.co and suppose the result is grade F: “Invalid certificate: Hostname mismatch, certificate is not valid for 'tienda-ejemplo.co'.” The table shows Covers this name ✗ No, and Names covered (SAN) lists only *.tienda-ejemplo.co. A wildcard covers one level, such as www.tienda-ejemplo.co or pagos.tienda-ejemplo.co, but not the bare domain and not two levels down. The fix is a certificate that lists both tienda-ejemplo.co and *.tienda-ejemplo.co.

For valid certificates the grade depends on the days left: A with 30 or more, B (amber) from 14 to 29, and C (red) under 14. The rest of the table shows the issuer, the start and end dates in UTC, whether it's self-signed, the TLS version and cipher agreed with our server, and the IP address we reached.

Load balancers, CDNs and a 10-minute cache

We make one connection to one address, preferring IPv4. If your domain points to several servers, or to a CDN with many locations, another server may be sending a different certificate. The TLS version shown is the one agreed with us; it doesn't prove that older versions are switched off.

Results are kept for 10 minutes, so wait a bit before re-checking a certificate you just installed. And the check says nothing about who runs the site: a valid certificate only means the connection to that name is encrypted.

FAQ

The site works in my browser. Why does it fail here?

Usually the server does not send its intermediate certificate. Some browsers find it on their own, but many apps, phones and APIs don't. Install the full chain (for example fullchain.pem).

How early should I renew a certificate?

At least 14 days before it expires. Let's Encrypt certificates usually last 90 days, and the common renewal tools (certbot, for example) renew them when about 30 days are left, so an amber result often means automatic renewal is broken.

Can I check a port other than 443 or an IP address?

No. Our server only connects to public domain names on port 443, the standard HTTPS port. That keeps it from being used to probe private networks or other services.

Does a valid certificate mean a site is safe to buy from?

No. Certificates are free and automatic, and scam sites get them too. The padlock only says the connection to that name is encrypted. Whether the name itself is the right one, and whether the business is honest, you have to check separately: look carefully at the domain and at how old it is.

What does self-signed mean?

A certificate the server signed for itself instead of getting it from a public authority. It encrypts, but no browser can confirm who's behind it, so visitors get a warning. It's fine for internal testing; on a public site, replace it with a free one from an authority such as Let's Encrypt.

Guides for this tool

G4How to spot a fake website and check if a store is legitCheck the address, the domain's age and the page itself to tell whether a website or online store is real, and what to do if you already paid.

1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
1.2Scammed or hacked? What nowSteps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent.
1.3Is this file safe?See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps.
1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.
1.5Website security scanPassive check of a website's homepage: HTTPS redirect, TLS certificate, HSTS, CSP, clickjacking, cookie flags and security.txt, with a grade and fixes.
1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
1.8Domain age checkerSee when a domain was registered, when it expires, its registrar and nameservers.
1.9Password generatorRandom passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator.
1.10Certificate decoderPaste a PEM certificate to read its subject, issuer, validity dates, SANs, key type and size, and its SHA-256 and SHA-1 fingerprints.
1.11Leaked password checkCheck if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.
1.12Link cleanerStrip utm_, fbclid, gclid, si and other tracking parameters from links before you share them.
1.13Watermark an ID copyStamp who a copy of your ID is for, and the date, across the whole photo or PDF, then download a smaller copy with no photo data.
1.14Encrypt textEncrypt and decrypt messages or notes with a password (AES-256-GCM) in your browser.

╌╌ END ╌╌