What is an SSL certificate?

An X.509 digital certificate binds a public key to a domain identity, signed by a Certificate Authority, enabling browsers to verify they are connecting to the legitimate server.

What is the difference between SSL and TLS?

TLS is the modern successor to SSL. The term SSL persists colloquially, but all current implementations use TLS 1.2 or TLS 1.3 protocols.

How do I check if my SSL certificate is expired?

Enter your domain in ScanSuite's SSL checker. The report displays not-before and not-after dates and flags certificates expiring within 30 days.

What is a certificate chain?

The chain includes your leaf certificate, one or more intermediate CA certificates, and ultimately chains to a trusted root CA stored in browser trust stores.

Why do browsers show "certificate not trusted"?

Common causes include expired certificates, hostname mismatches, self-signed certificates, or missing intermediate certificates in the server chain.

What are Subject Alternative Names (SAN)?

SAN entries list all domain names and IP addresses covered by a certificate. Modern browsers require hostname matches in SAN, not just the legacy CN field.

What cipher suites should I use?

Prefer TLS 1.3 AEAD ciphers or TLS 1.2 ECDHE suites with AES-GCM or ChaCha20-Poly1305 providing forward secrecy and authenticated encryption.

What is forward secrecy?

Forward secrecy (FS) ensures session keys cannot be decrypted later even if the server's long-term private key is compromised. ECDHE key exchange provides FS.

What is OCSP stapling?

OCSP stapling attaches fresh certificate revocation status to the TLS handshake, improving performance and privacy compared to client-side OCSP lookups.

How often should I scan SSL certificates?

Scan weekly for production domains and immediately after certificate renewals, CDN migrations, or DNS changes affecting HTTPS endpoints.

Does a wildcard certificate cover all subdomains?

A wildcard like *.example.com covers one subdomain level (api.example.com) but not nested subdomains (v2.api.example.com) or the bare apex domain.

What is HSTS and how does it relate to SSL?

HTTP Strict Transport Security forces browsers to use HTTPS only. It complements valid certificates by preventing protocol downgrade attacks.

Can I check SSL on non-standard ports?

Yes. Specify the port when scanning services like SMTPS (465), IMAPS (993), or custom HTTPS ports discovered via port scanning.

What SSL grade should I target?

Aim for A or A+ grades with valid certificates, TLS 1.2+ only, strong ciphers, and HSTS enabled. B grades indicate fixable weaknesses.

What happens when Let's Encrypt renewal fails?

The existing certificate remains valid until expiry, then browsers show trust errors. Monitor expiry dates and automate renewal verification with SSL scans.

Are self-signed certificates acceptable?

Self-signed certificates are fine for internal services but cause browser warnings on public websites. Use publicly trusted CAs for customer-facing domains.

What is certificate transparency?

CT logs publicly record issued certificates, enabling detection of unauthorized or misissued certs for your domains through monitoring services.

Is this SSL checker free?

Yes. ScanSuite provides unlimited free SSL/TLS scans on public hostnames without registration or daily caps.

Free SSL Checker — Certificate & TLS Scan

An SSL checker connects to a target hostname over HTTPS, retrieves the presented X.509 certificate chain, validates expiry dates and chain of trust against trusted root CAs, enumerates supported TLS protocol versions and cipher suites, and assigns a security grade based on certificate health, protocol deprecation, and cryptographic strength.

Enter any domain name into ScanSuite's SSL checker and run the scan. The tool connects via TLS, displays certificate subject, issuer, validity dates, SAN entries, chain completeness, supported protocols, cipher suites, and an aggregate HTTPS security grade with prioritized remediation recommendations.

Transport Layer Security (TLS) encrypts data in transit between browsers and servers, authenticates server identity through X.509 certificates, and underpins trust for e-commerce, banking, healthcare, and every HTTPS API. Expired certificates, incomplete chains, weak cipher suites, and deprecated protocol versions cause browser warnings, service outages, and exploitable downgrade paths.

ScanSuite's free SSL checker performs remote TLS handshakes against any public hostname, extracting certificate details, validating the chain of trust, detecting imminent expiry, and grading overall HTTPS posture. Results help developers, security teams, and compliance auditors maintain continuous certificate hygiene without installing OpenSSL or sslyze locally.

ScanSuite's free SSL checker validates TLS certificates, chain of trust, expiry dates, supported protocols, and cipher suites for any domain. Get HTTPS security grades, detect imminent certificate expiration, and receive actionable remediation guidance to maintain trusted encrypted connections.

Frequently Asked Questions

What is an SSL certificate?: An X.509 digital certificate binds a public key to a domain identity, signed by a Certificate Authority, enabling browsers to verify they are connecting to the legitimate server.
What is the difference between SSL and TLS?: TLS is the modern successor to SSL. The term SSL persists colloquially, but all current implementations use TLS 1.2 or TLS 1.3 protocols.
How do I check if my SSL certificate is expired?: Enter your domain in ScanSuite's SSL checker. The report displays not-before and not-after dates and flags certificates expiring within 30 days.
What is a certificate chain?: The chain includes your leaf certificate, one or more intermediate CA certificates, and ultimately chains to a trusted root CA stored in browser trust stores.
Why do browsers show "certificate not trusted"?: Common causes include expired certificates, hostname mismatches, self-signed certificates, or missing intermediate certificates in the server chain.
What are Subject Alternative Names (SAN)?: SAN entries list all domain names and IP addresses covered by a certificate. Modern browsers require hostname matches in SAN, not just the legacy CN field.