SSL Certificate Checker

Run before and after renewals, CA migrations, or Let's Encrypt rate-limit incidents. Expiry within thirty days should trigger automation or manual reissue — the checker reads live not-after dates from the wire, not calendar reminders in your inbox.

After CDN or origin moves, confirm the new edge presents the intended cert SAN list. Customers hitting www while the cert covers only apex (or reverse) see browser warnings despite «working» curl from ops laptops with Host header tricks.

Chain completeness issues surface as Android or Java failures while desktop Safari succeeds. Inspect intermediate certificates in the checker output and install the CA bundle your provider documents. DIG on CAA before blaming the CA — restrictive CAA blocks issuance silently until DNS fixes land.

Compliance questionnaires ask for TLS version and cipher posture. The checker reports negotiated protocol versions useful for «TLS 1.2+ only» attestations — not a full PCI ASV scan replacement.

Incident response on suspected MITM compares issuer and serial against known good archives you maintain. DN01 shows current wire presentation only — not historical CT log diffs or enterprise inventory unless you script API snapshots yourself.

Multi-tenant SaaS on wildcard certs should still list customer vanity domains explicitly when tenants bring BYO certificates — wildcard *.platform.com does not cover tenant.com without SAN or separate cert.

IoT fleets with long-lived devices may trust expired roots — server-side TLS 1.3 upgrade breaks legacy firmware; certificate checker on prod hostname documents what modern clients see while product teams assess embedded trust stores separately.

Load balancer health checks using self-signed certs on backend pools do not affect public leaf cert — keep public SSL checker focused on customer-facing VIP hostnames during infra drills.

Hostname mismatch means the cert SAN list lacks the label in your URL — fix DNS CNAME/A to a covered name or reissue with correct SANs. Wildcards cover one level (*.example.com) not nested api.staging.example.com unless explicitly listed.

Expired or not-yet-valid certs clock-skew on servers — verify NTP on origin VMs. Renewal automation may have failed while HTTP validation paths broke due to A record drift — DNS Checker first, then SSL checker.

Untrusted issuer or incomplete chain: install intermediates on the origin or CDN, not only the leaf. Some panels upload leaf only; browsers cache AIA fetches that strict APIs disallow.

TLS version too low: upgrade web server or load balancer configs. Legacy clients forcing TLS 1.0 may still fail after server hardening — separate product decision from cert validity itself.

OCSP stapling missing is not always fatal — some clients fetch OCSP live. Note stapling in checker output when hardening high-traffic sites to reduce handshake latency and privacy leaks.

HTTP-01 and TLS-ALPN-01 validation require reachable hosts on the names in the CSR. DNS Checker confirms A/AAAA before SSL troubleshooting — chasing chain errors on an IP that no longer belongs to you wastes hours.

CAA DNS records restrict which CAs may issue. DIG or DNS Checker on CAA before opening CA support tickets. Zero issue tags mean only listed CAs can sign; accidental CAA during copy-paste templates blocks renewals until removed.

HSTS and redirect headers from HTTP header checker reduce accidental http-01 failures when http URLs must answer with specific tokens. Mixed content and CSP do not change cert validity but break lock icons — layer header review after chain is sound.

DN01 SSL checker connects from our infrastructure — a pass here does not guarantee every geographic vantage sees the same cert on multi-CDN setups. For geo-specific edge certs, sample from multiple networks or use your CDN's cert status panel; we do not map global edge presentation.

Private CAs for internal mTLS do not appear in public trust stores — checker against internal hostnames still validates wire presentation for ops debugging even when public browsers would reject the same issuer.

Qualys SSL Labs delivers deep grades, cipher suites, and vulnerability narratives — excellent for quarterly audits, slower for «is today's cert expired?» DN01 optimizes fast chain and SAN verification with companion DNS and header tools on one domain — not a replacement for Labs when you need exhaustive cipher scoring.

Uptime monitors ping expiry weekly and page on-call. DN01 browser checks are manual or API-driven snapshots without bundled paging — honest scope for operators who already own monitoring but need a quick cert read during incidents.

Browser padlock UIs hide chain details and may cache prior states. Wire-level checker bypasses browser cache for the hostname you type. We do not install browser extensions or MITM corporate roots — standard TLS handshake from our fetchers.

No fake «A+» marketing badge, no claim to scan entire subnets, no propagation maps. Accurate leaf-and-chain readout, eight locales, local history, API for scripts — pair with WHOIS and Blacklist Checker when investigating suspicious hosts, not when cert alone should grant trust.

Renewal calendars in enterprise PKI teams track every SAN and intermediate — DN01 does not replace those systems. Use our checker when an on-call engineer needs immediate wire truth during a Sev2, then file the screenshot into your existing CMDB or ticket queue where long-term cert inventory actually lives.

Certificate pinning in mobile apps breaks silently when you rotate leaf certs without app updates — SSL checker validates public TLS while app teams manage pin hashes in release trains; keep both workstreams linked in major rotation projects.

EV certificate organizational fields rarely appear in modern DV-heavy stacks — do not expect extended validation metadata in checker output unless your CA and purchase tier actually issue EV; focus on SAN and chain for typical Let's Encrypt deployments.

TLS 1.0 sunset projects should test legacy integration partners after disabling old protocols — checker documents successful modern handshake while partner teams update their clients on separate timelines.

Self-signed certs in staging intentionally fail public trust — use checker to confirm expected issuer CN matches your internal CA naming standard before promoting config to production keystores.

Certificate transparency logs help detect mis-issued certs — DN01 does not search CT logs; wire check complements but does not replace CT monitoring products.

mTLS between microservices uses internal CAs — public SSL checker on internal DNS names still helps debug handshake failures during mesh upgrades when operators lack openssl on jump boxes.