SSL/TLS Domain Checker

Processing: API. Processed by cent-ai's API: sent to our server, held in memory, never stored.

Enter a domain to check its certificate's trust, expiry, hostname match, and chain in one bounded TLS connection. Nothing you enter here is stored or logged.

How to use it

  1. Enter a hostname, e.g. example.com or example.com:8443.
  2. Select “Run check” to connect and analyze the certificate.
  3. Review findings, then expand the chain/technical details.

Example

Select “Use example” above to load a sample domain.

Privacy and security

  • The hostname is sent to our API only to run the check; it is never persisted or logged.
  • Private, loopback, link-local, and other reserved IP ranges are blocked.
  • Exactly one TLS connection is made — no port scanning, no cipher enumeration.

Limitations

  • Defaults to port 443; a custom port can be specified as host:port.
  • Reports the chain as presented by the server — does not attempt alternate chain-building.
  • No active vulnerability probing (e.g. Heartbleed-style checks) — defensive inspection only.

FAQ

Does this scan for weak ciphers or known vulnerabilities?

No. It reports the protocol and cipher actually negotiated in one connection — this is a defensive health check, not a vulnerability scanner or cipher enumerator.

What counts as "healthy"?

The overall result distinguishes Healthy, Warning, Critical, and Unable to check — it does not collapse everything into a single letter grade. Expiry severity specifically: healthy at 60+ days remaining, watch at 30–59, warning at 7–29, critical under 7, expired at 0 or fewer.

How is this different from the Certificate Chain Validator?

This tool is a general certificate-health check (trust, expiry, hostname, protocol/cipher). The Chain Validator focuses specifically on the intermediate/root chain — ordering, missing intermediates, and per-certificate expiry within the chain.