Why check your certificates online
A green padlock in the browser tells you very little. It reveals neither an incomplete chain of trust, nor an imminent expiry, nor a hostname missing from the SAN entries. Likewise, submitting a CSR without checking it against the Baseline Requirements often leads to a rejection by the certificate authority, and publishing a BIMI record with an invalid VMC prevents your logo from displaying. These three tools remove the doubt before the problem reaches your users.
Common use cases:
- Check a live HTTPS certificate → Verify a server certificate's validity, expiry and chain from its domain
- Diagnose a missing intermediate → Understand why a site works in Chrome but breaks under curl or in email clients
- Validate a CSR before submission → Get a compliance verdict and the list of findings to fix before issuance
- Prepare a BIMI certificate → Confirm that the VMC covers your domains and stays valid
These one-off checks belong to a wider practice: inventorying your certificates, knowing who owns them and who renews them. Our certificate lifecycle management guide covers that inventory and the roles to assign.
How to check your certificates
Three steps: pick the tool, provide the input, read the verdict.
Step 1: Pick the tool
| Need | Tool to use |
|---|---|
| Check a live HTTPS certificate | SSL Certificate Checker |
| Check a certificate request (CSR) for compliance | CSR Parser |
| Validate a BIMI certificate (VMC) | VMC Certificate Analyzer |
Step 2: Provide the input
The SSL Certificate Checker starts from a domain name and opens the TLS connection itself. The CSR and VMC parsers take a pasted PEM block, or an HTTPS URL for the VMC.
Accepted inputs:
- HTTPS server: a domain, for example
captaindns.com(port 443 by default) - CSR:
-----BEGIN CERTIFICATE REQUEST----- - Certificate:
-----BEGIN CERTIFICATE-----
Step 3: Read the verdict
Depending on the tool, the result shows:
- Verdict: trusted, expiring soon, incomplete chain, hostname not covered or self-signed
- Subject: CN, O, OU, L, ST, C
- SAN: DNS, IP, URI, including wildcards
- Validity: start and end dates, days remaining
- Chain: intermediate certificates up to the root
- Fingerprints: SHA-1, SHA-256
Tool details
Each tool starts from a different input and returns its own verdict.
Live SSL certificate checker
The SSL Certificate Checker opens a TLS connection to a server and inspects the certificate it presents:
| Check | Description |
|---|---|
| Verdict | One state among trusted, expiring soon, incomplete chain and self-signed |
| Expiry | End date and number of days remaining, with a warning as the deadline approaches |
| Chain of trust | Detection of a missing intermediate certificate that Chrome silently compensates for |
| Hostname | Presence of the domain in the SAN entries, accounting for wildcards |
| Strength | Key too weak (RSA < 2048, ECDSA < 256) or obsolete signature (SHA-1, MD5) |
Use case: Get a verdict the browser does not give, and spot a problem that breaks curl, email clients and mobile devices. This tool covers the HTTPS web; for a mail server over STARTTLS, use the SMTP/MX tester.
Since 15 March 2026, certificate authorities must also validate DNSSEC at issuance: a signed but broken zone can now block a renewal. We cover that in CA DNSSEC validation and TLS certificates.
Certificate signing request (CSR) parser
The parser decodes a Certificate Signing Request. Every measured fact is then checked against the CA/Browser Forum Baseline Requirements and the applicable RFCs:
| Check | Description |
|---|---|
| Verdict | Compliant, warning or non-compliant, with the findings and their normative source |
| Subject | CN, O, OU, L, ST, C, and the fields a public authority rejects or strips |
| Subject Alternative Names | Requested DNS names and IPs, wildcard entries, internal names, reserved IPs |
| Public key | Algorithm, size, ROCA (CVE-2017-15361) and Debian weak key (CVE-2008-0166) detection |
| Signature | The CSR signature algorithm, from obsolete digests to SHA-256 |
| SPKI fingerprint | SHA-256 digest of the public key, in hexadecimal and base64 |
| Deployed certificate | Optional comparison with the certificate a host serves, by SPKI fingerprint |
Use case: Know before paying whether the certificate authority will accept the request, fix the blocking findings and regenerate the CSR only once.
BIMI VMC certificate analyzer
The analyzer inspects a Verified Mark Certificate for BIMI:
| Field | Description |
|---|---|
| Issuer | Certificate authority (DigiCert, Entrust, GlobalSign, among others) |
| Validity | Start and expiry dates |
| Certified domains | SAN entries covered by the VMC |
| Chain of trust | Intermediate certificates up to the root |
Use case: Confirm that the VMC is valid and covers your sending domains before publishing the BIMI record. If a domain is missing from the SAN entries, the logo will not display. To choose between a VMC and a CMC, and to know the cost and the paperwork involved, read our VMC and CMC certificate guide.
Shorter certificate lifespans
The CA/Browser Forum ballot SC-081v3 lowers the maximum lifespan of public TLS certificates in three steps. Since 15 March 2026 the cap is 200 days. It drops to 100 days on 15 March 2027, then to 47 days on 15 March 2029, with domain control validation reuse falling to 10 days at that point. Our guide walks through the timeline and the action plan: 47-day TLS certificates, why and how to prepare.
At that cadence, manual renewal no longer holds: you need an ACME pipeline that renews, reloads the service and verifies the result, as described in our TLS certificate renewal automation playbook.
To be warned before an outage rather than checking by hand, turn verification into continuous monitoring with the uptime monitor, which checks expiry at regular intervals and alerts you as the deadline nears.
FAQ - Frequently asked questions
Q: How do I check an SSL certificate online?
A: Enter a domain name in the SSL Certificate Checker. The tool opens a real TLS connection to the host (port 443 by default), inspects the server certificate and the presented chain, then returns a verdict: trusted, expiring soon, incomplete chain, hostname not covered or self-signed.
Q: What is the difference between a server, intermediate and root certificate?
A: The server certificate carries your domain name. The intermediate links back to the root, which lives in the system trust store. The server must present the server certificate followed by the intermediates: this is what is called the full chain (fullchain).
Q: What is a CSR and why analyze it?
A: A CSR (Certificate Signing Request) is the request sent to a certificate authority to obtain a certificate. Analyzing it before submission lets you verify that the subject, SAN entries and algorithm match your expectations, which avoids rejections and incorrect certificates.
Q: What is a VMC certificate for BIMI?
A: A VMC (Verified Mark Certificate) is a certificate issued by an authorized certificate authority (DigiCert, Entrust or GlobalSign, among others) that binds your logo to your legal identity. It is required to display your logo in BIMI-compatible email clients like Gmail, Apple Mail and Yahoo.
Q: Why does my site work in Chrome but break elsewhere?
A: This is often a sign of a missing intermediate certificate. Chrome and Edge fetch the missing intermediate automatically, but curl, email clients and many mobile devices reject the connection. The SSL Certificate Checker flags the incomplete chain; serve the full chain (fullchain) to fix it everywhere.
Q: How long does an SSL certificate stay valid?
A: Up to 200 days since 15 March 2026, the first phase of the CA/Browser Forum ballot SC-081v3. The cap drops to 100 days on 15 March 2027, then to 47 days on 15 March 2029. That cadence makes automation via ACME and expiry monitoring essential.
Q: Do the tools support wildcard certificates?
A: Yes. The parsers show wildcard SAN entries (*.captaindns.com) and distinguish them from specific entries. When checking the hostname, the SSL Certificate Checker accounts for the fact that a wildcard covers neither the apex nor deeper subdomains.
Q: Can I analyze a certificate from a URL?
A: Yes. The VMC certificate analyzer accepts an HTTPS URL pointing to a hosted PEM file: the tool downloads the certificate and analyzes it without keeping it. The SSL Certificate Checker, on the other hand, starts directly from a domain name.
Q: Are my certificates and CSRs kept?
A: No. The analysis does not run in your browser: the domain, CSR or certificate you submit is sent to our API in Europe, decoded, and not kept after processing. The CSR content is stripped from our request logs. No private key is ever requested: a CSR and a certificate only carry the public key.
Complementary tools
| Tool | Purpose |
|---|---|
| BIMI record check | Validate the complete BIMI record (DNS + logo + VMC) |
| BIMI logo checker | Check the SVG Tiny-PS compliance of your logo |
| DMARC inspector | Verify the DMARC policy required for BIMI |
| SMTP/MX tester | Inspect a mail server's certificate over STARTTLS |
| DANE/TLSA checker | Pin a certificate by fingerprint in DNS |
| HSTS test | Check the HSTS policy and preload list eligibility |
| HTTP headers analyzer | Grade the security headers served with your certificate |
Useful resources
- RFC 2986 - PKCS #10 CSR (Certificate Signing Request specification)
- BIMI Group - VMC Requirements (requirements for VMC certificates)
- CA/Browser Forum - Baseline Requirements (rules for public certificates)
- DigiCert - VMC Documentation (VMC acquisition guide)