Public HTTPS evidence · port 443 only
Free SSL/TLS certificate checker.
Inspect the certificate a public website presents, including CA-path validation, hostname coverage, expiry, public key and the TLS connection negotiated from our observation point.
Check a certificateInspect one public hostname
See the certificate visitors are offered.
Enter a hostname or web URL. The path is ignored because certificates identify services by hostname.
Certificate check. We connect to the public website on HTTPS port 443 and inspect the certificate it presents.
A narrow, honest diagnostic
A certificate check—not a website safety verdict.
This tool is not a vulnerability scan, penetration test, malware verdict, ownership check or guarantee that every visitor sees the same edge.
Read RFC 9525 service identity guidance- 01
Validate the target
Only a fully qualified hostname resolving entirely to public addresses is allowed. Connections are pinned to a validated address on port 443.
- 02
Observe the TLS endpoint
We send SNI, validate the CA path and record one negotiated connection. If trust fails, a second bounded handshake may retrieve the certificate solely for explanation.
- 03
Match the right identity
Hostname matching uses dNSName entries from Subject Alternative Name. A common name is displayed but not treated as the website identity.
- 04
Keep the blind spots visible
No complete revocation, protocol-range, cipher-suite, multi-region or every-edge assessment is claimed. Use monitoring for ongoing assurance.
Certificate questions
What this result can—and cannot—tell you.
Does a valid TLS certificate mean a website is safe?
No. It supports encrypted transport and hostname authentication. It does not prove the site is trustworthy, vulnerability-free or free of harmful content.
Does this test every TLS version, cipher or CDN edge?
No. It records one negotiated connection from ACA's observation point to one reachable public address. Different regions and edges may present different configurations.
Does the checker test certificate revocation?
No. It does not claim a complete OCSP or CRL revocation assessment. That limitation remains visible even when the public CA path validates.
Why can I only check port 443?
This public tool is deliberately limited to the standard HTTPS service. It is not a general port scanner or a checker for mail, database or private network services.