SSL Certificate Checker
Check whether a website's SSL/TLS certificate is trusted, matches the domain and is in date, and see when it expires, who issued it and which domains it covers.
What This Checker Tests
Enter a domain and Orbit2x's server opens a TLS connection to it, just as a browser does when you visit an https:// address. It reads the certificate the server sends and makes the same three checks a browser makes before showing the padlock:
- Trusted issuer: the certificate links, through any intermediate certificates the server sends, to a root certificate authority in the standard trust store.
- Hostname: the certificate's list of names (the Subject Alternative Names) includes the domain you entered.
- Validity dates: today falls between the certificate's "valid from" and "valid until" dates.
If all three pass, the result is valid. A valid certificate that expires within 30 days is flagged as expiring soon. You also get the certificate's details (issuer, domains covered, key type, serial number and SHA-256 fingerprint), the chain the server sent, and the TLS version and cipher suite that were negotiated.
Reading the Results
- Issued to / Domains covered: browsers use the domains list, not the "issued to" name, to decide whether the certificate matches.
- Issued by: the certificate authority (or its intermediate) that signed it, such as Let's Encrypt, DigiCert or Sectigo.
- Chain sent by the server: numbered from 2, because 1 is the site's own certificate. Usually one or two intermediates. A server that sends only its own certificate is a common cause of trust errors.
- Public key: RSA keys should be at least 2048 bits; ECDSA P-256 is a common, faster alternative.
- SHA-256 fingerprint: a unique identifier for this exact certificate, useful to confirm which certificate a server is using after a renewal.
Common Certificate Errors and Fixes
Expired certificate
NET::ERR_CERT_DATE_INVALID (Chrome), SEC_ERROR_EXPIRED_CERTIFICATE (Firefox)
Cause: The certificate's "valid until" date has passed, usually because automatic renewal stopped working.
Fix: Renew it with your certificate authority or ACME client (such as Certbot), install the new certificate, and reload the web server. Then find out why renewal failed so it doesn't happen again.
Name mismatch
NET::ERR_CERT_COMMON_NAME_INVALID (Chrome), SSL_ERROR_BAD_CERT_DOMAIN (Firefox)
Cause: The certificate doesn't list the hostname being visited. A common case is a certificate for example.com used on www.example.com. A wildcard *.example.com covers one level of subdomain, such as www.example.com, but not example.com itself or a.b.example.com.
Fix: Get a certificate that includes every hostname you serve, or redirect the extra hostnames to one that's covered. Remember the redirect itself happens over HTTPS, so the redirecting hostname needs a valid certificate too.
Missing intermediate certificate
NET::ERR_CERT_AUTHORITY_INVALID (Chrome), SEC_ERROR_UNKNOWN_ISSUER (Firefox)
Cause: Most certificates are signed by an intermediate certificate, not directly by a root. If the server doesn't send the intermediate, browsers often cope (Chrome and Safari can download it, and Firefox ships a list of known intermediates), but many apps, scripts and command-line tools fail.
Fix: Configure the server with the full chain file your CA provides (often called fullchain.pem): your certificate first, then the intermediates. You don't need to include the root.
Self-signed or untrusted issuer
NET::ERR_CERT_AUTHORITY_INVALID (Chrome), SEC_ERROR_UNKNOWN_ISSUER (Firefox)
Cause: The certificate was made by the server itself or by a private CA that browsers don't trust. That's normal for internal test systems, but not for a public site.
Fix: Use a certificate from a publicly trusted CA. Let's Encrypt and several others issue free certificates automatically using the ACME protocol.
Checking a Certificate Yourself
In a browser, click the icon to the left of the address and open the connection or certificate details. From a terminal:
openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
That prints the subject, issuer, validity dates and domain names of the certificate the server sends. The -servername option matters: servers hosting several sites use it to pick the right certificate.
How the Check Is Made
The domain you enter is sent to Orbit2x's server, which connects to it once and reads the certificate. No web page is requested and nothing is stored. Private and local network addresses are refused. Trust is checked against the standard certificate authority list installed on Orbit2x's server, which closely matches what browsers trust but isn't identical to every browser and operating system. See the privacy policy for general data practices.
Frequently Asked Questions
Does this checker test for vulnerabilities or give a grade?
No. It checks the certificate the way a browser would decide whether to show a warning: trusted issuer, matching hostname and validity dates. It also shows the TLS version and cipher that were negotiated. It doesn't test every protocol version, check revocation or scan for vulnerabilities; for a full configuration review, a dedicated scanner such as SSL Labs' Server Test goes much further.
Why does my site work in Chrome but fail here?
Usually because the server isn't sending its intermediate certificate. Browsers can often fill the gap by downloading the intermediate or using a built-in copy; this checker, like many apps and command-line tools, doesn't. If the trust check fails with "isn't sending the intermediate certificate(s)", install the full chain on the server.
How long do certificates last?
Publicly trusted certificates have a maximum lifetime set by the CA/Browser Forum. The limit was 398 days for several years and is being reduced in stages: to 200 days for certificates issued from March 2026, 100 days from March 2027 and 47 days from March 2029. Let's Encrypt issues 90-day certificates by default and has announced plans to shorten them. Shorter lifetimes make automatic renewal essential.
Does a certificate's validation level (DV, OV, EV) change the encryption?
No. Domain-validated, organization-validated and extended-validation certificates all give the same encryption. The difference is how much the CA checked about who requested the certificate. Browsers no longer highlight EV certificates in the address bar.
Can I check a server on a port other than 443?
Yes. Add the port to the hostname, for example mail.example.com:993 or example.com:8443. The service on that port must start TLS straight away; services that upgrade a plain connection with STARTTLS, such as SMTP on port 587, can't be checked here.