What TLS Certificate Checker checks
A certificate file can look correct while the live endpoint serves a different chain, misses a SAN, or negotiates an unexpected protocol. This checker connects to a bounded public destination and reports the certificate actually presented by the service.
Common uses
- Confirm the certificate served after an Nginx or CDN change
- Check SAN coverage, issuer, fingerprint, and remaining validity
- Diagnose trust-chain, hostname, and TLS-version failures
Privacy, safety, and limitations
The domain or public IP is sent to ParseNest for a live network check and is not stored. Private, loopback, link-local, reserved, and documentation addresses are rejected; ports and execution time are restricted.
Results reflect the check time and the server's network. DNS, CDN routing, and remote configuration can change afterward.
Frequently asked questions
Does this replace a browser or OpenSSL test?
No. It provides a fast server-side view. Client trust stores, geographic routing, SNI, and enterprise proxies can produce different results.
Can it inspect an expired or untrusted certificate?
Yes. The handshake is inspected and trust verification is reported separately so configuration failures remain visible.
Which ports are supported?
Common direct-TLS ports are supported, including 443, 465, 993, 995, 8443, 9443, and 10443. STARTTLS-only ports are intentionally excluded.