Practical guide
How to inspect a TLS certificate
Use this page to check what certificate an endpoint actually serves, whether it is trusted, and whether it is close to expiration.
What this tool checks
The TLS inspector opens a TLS connection to the host and reads the certificate details presented by the server. The important fields are the subject names, issuer, validity window, certificate chain, fingerprint, and trust status. This reflects the live endpoint, not just what your certificate provider says was issued.
When to use it
Use it before renewing a certificate, after changing a CDN or load balancer, when users report browser warnings, or when a domain serves the wrong certificate. It is also useful after a deployment because backend and edge systems can serve different certificates if one layer was missed.
How to read the result
First check that the requested hostname appears in the subject alternative name list. Then check the not-before and not-after dates, the issuer, and whether the chain is trusted. A valid certificate can still be wrong if it does not cover the hostname users are visiting.
Example TLS inspection
- Example input
example.com:443- Example result
subject: example.com issuer: DigiCert Global G3 TLS ECC SHA384 2020 CA1 valid to: 2026-01-15 trusted: true
The hostname must be covered by the certificate names, and the full chain must be trusted by normal clients.
Related tools
Related guides
FAQ
Why does the certificate look valid but my browser still warns users?
What is a subject alternative name?
Can this check non-HTTPS ports?
Last reviewed: 2026-05-20.