Free tools / SSL certificate checker
SSL certificate & expiry checker
Connect to any hostname over TLS and inspect its certificate subject, issuer, valid-from and expiration dates, days remaining, TLS version, and chain issues.
Target host
port 443 or 8443Valid TLS certificate. Trusted by standard root stores and covers scaledpapers.com.
Want an alert before this certificate or HTTPS endpoint fails? Monitor scaledpapers.com for free →
scaledpapers.com:443
Example inspection- Subject (CN)
- scaledpapers.com
- Issuer
- Let's Encrypt (YE2)
- Valid from
- 2026-09-23 02:57 UTC
- Valid until
- 2026-12-22 02:57 UTC (90-day certificate)
- Protocol & cipher
- TLSv1.3 · TLS_AES_256_GCM_SHA384
- Handshake & IP
- 52 ms · 104.21.20.57
- SANs (2)
- *.scaledpapers.com, scaledpapers.com
- Serial number
- 06:22:12:81:DC:6D:3D:44:8A:87:25:98:40:B1:D9:55:A6:EE
- SHA-256 fingerprint
- 65:69:1B:D0:40:38:DF:85:B5:81:FC:29:C7:CC:C3:F3:23:A2:41:F1:39:D4:B2:B4:18:46:88:61:80:D5:99:B2
| Role | Subject | Issuer | Validity |
|---|---|---|---|
| Leaf | scaledpapers.com | Let's Encrypt (YE2) | 60d left |
| Issuer | YE2 (Let's Encrypt) | Trusted Root CA | Trusted |
How this SSL certificate checker works
When you check a hostname, ScaledPapers resolves its public IP address, opens a fresh TCP connection to port 443 (or 8443), and performs a TLS handshake with Server Name Indication (SNI) set to the hostname you entered. We validate the peer certificate against the standard Mozilla/OpenSSL root store and decode the X.509 fields directly from the wire.
If verification fails — for example because the certificate expired yesterday, is self-signed, or is missing an intermediate CA — the checker runs a second unverified handshake so you can still see the exact certificate dates, Subject Alternative Names, and OpenSSL verification error instead of a generic connection failure.
Common SSL certificate and chain issues
| Failure | OpenSSL error | What causes it |
|---|---|---|
| Expired certificate | certificate has expired (code 10) |
The notAfter timestamp is in the past. Usually a failed Certbot/ACME renewal timer or a web server (Nginx, Envoy, ALB) that was never reloaded after the new PEM file was written to disk. |
| Missing intermediate (incomplete chain) | unable to get local issuer certificate (code 20) |
The server was configured with cert.pem instead of fullchain.pem. Desktop browsers often mask this by fetching the missing intermediate via Authority Information Access (AIA), while curl, Python, Go, and webhook senders fail immediately. |
| Hostname mismatch | Hostname mismatch (code 62) |
The requested host is not listed in the certificate's Subject Alternative Name (SAN) extension. Common when a certificate covers example.com but not www.example.com, or when an CDN/ingress falls back to its default certificate because SNI did not match a virtual host. |
| Self-signed certificate | self-signed certificate (code 18) |
The certificate's subject and issuer are identical and not in any public root store. Expected on internal origins behind Cloudflare Full (non-strict), fatal on public endpoints. |
Inspecting a certificate from your terminal
To reproduce what this checker does from a shell, pass -servername to openssl s_client so SNI selects the right virtual host:
echo | openssl s_client -connect scaledpapers.com:443 -servername scaledpapers.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltNameFrequently asked questions
- Why does my HTTPS site work in Chrome but fail in curl, Python, or webhooks?
- Almost always an incomplete certificate chain. Desktop Chrome and Safari use AIA (Authority Information Access) fetching or cached intermediates to fill in a missing intermediate CA certificate on the fly. Command-line tools, language HTTP clients (
requests,httpx,net/http), and webhook delivery workers only trust what the server sends during the TLS handshake. Servefullchain.pem(leaf + intermediate) rather than the leaf certificate alone. - How long are SSL certificates valid?
- Public TLS certificates are currently capped at 398 days under CA/Browser Forum baseline requirements, and Let's Encrypt certificates are valid for 90 days (normally renewed 30 days before expiry). As certificate lifetimes shorten toward 47 days, manual renewal reminders stop scaling — automated ACME renewal paired with external HTTPS monitoring is required.
- What is the difference between Common Name (CN) and Subject Alternative Name (SAN)?
- Modern TLS clients ignore the legacy Common Name field when matching hostnames and check only the
dNSNameentries inside the Subject Alternative Name (SAN) extension (RFC 6125 / RFC 9525). A single certificate can cover apex,www, and wildcard subdomains in its SAN list. - Can I share a link to a certificate check?
- Yes. The checked hostname is saved in the URL query string as
?host=example.com, so pasting the URL into an incident channel or ticket runs a fresh check for that host.
Get alerted before your certificate or HTTPS endpoint fails
An expired certificate or broken intermediate chain takes down production just as hard as a 500 error. ScaledPapers checks your HTTPS endpoints from five regions, confirms failures before opening an incident, and alerts you by email, Slack, Discord, PagerDuty, or webhook. Free for 5 checks, no card.