BEFORE YOU START

A certificate file can look correct while a load balancer still serves an older or incomplete chain. Diagnose the live endpoint and keep transport, identity, and trust as separate checks.

FOLLOW ALONGOpen the live TLS Certificate Checker workspace
01

Query the public endpoint

Use the exact hostname clients use so SNI selects the correct certificate. Record the resolved IP when multiple regions are involved.

EXAMPLE
example.com:443
02

Verify identity and validity

Confirm the SAN contains the hostname and that the current time is between Not Before and Not After.

EXAMPLE
Subject Alternative Name / Not After
03

Inspect the presented chain

The leaf should be followed by the required intermediate certificates. Servers normally should not send an unnecessary root certificate.

EXAMPLE
leaf → intermediate
04

Retest after deployment

Check the live endpoint from more than one network after replacing a certificate or CDN configuration.

EXAMPLE
openssl s_client -connect example.com:443 -servername example.com
Key takeaways
  • Check the live endpoint, not only a local PEM file.
  • Hostname, expiry, and chain trust are separate failures.
  • SNI and regional routing can change the certificate served.