SSL Certificate Checker
Deep-dive SSL/TLS analysis tool. Verify expiration dates, visualize the Chain of Trust, inspect Subject Alternative Names (SANs), and detect rogue certificates using public Transparency Logs.
About
Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cryptographic backbones of the modern web. However, a valid padlock icon does not guarantee a healthy security posture. Misconfigured intermediate chains, deprecated hashing algorithms, or unexpected certificates issued by unauthorized Certificate Authorities (CAs) can leave systems vulnerable or inaccessible.
This tool leverages Certificate Transparency (CT) Logs to perform a deep audit of a domain's certificate history. Unlike standard checkers that only ping the server, this utility retrieves the public ledger of certificates issued for the domain. This allows for the detection of Shadow IT issuance and provides a timeline of security updates.
Mathematical integrity in cryptography relies on the difficulty of prime factorization. For an RSA key, the public key n is the product of two large primes p and q. The security strength is often denoted by the bit length of n (e.g., 2048 or 4096). This tool estimates the health of your encryption configuration based on these standards.
Formulas
The validity of a certificate is determined by the current time t relative to the issuance window. A certificate is valid if and only if:
The remaining lifespan L is calculated as:
Where t is measured in milliseconds. Security warnings are triggered when L drops below a safety threshold (typically 14-30 days).
Reference Data
| Security Attribute | Standard / Recommended Value | Risk Threshold (Deprecated) | Technical Context |
|---|---|---|---|
| Public Key Size (RSA) | 2048 bits or 4096 bits | ≤ 1024 bits | Determines the computational effort required to break the encryption via factorization. |
| Signature Algorithm | SHA-256 (sha256WithRSA) | SHA-1, MD5 | Hash functions ensure integrity. Older algorithms (SHA-1) are vulnerable to collision attacks. |
| Validity Period | 90 to 397 days | > 825 days | Shorter validity reduces the window of opportunity for compromised keys. |
| Certificate Authority | Trusted Root (e.g., DigiCert, ISRG) | Self-Signed, Unknown | The entity that validates the domain ownership. Browsers rely on a pre-installed Root Store. |
| Protocol Version | TLS 1.2 or TLS 1.3 | SSL 3.0, TLS 1.0, TLS 1.1 | Newer protocols support modern cipher suites (e.g., AEAD) and faster handshakes. |
| Transparency Log | Present | Absent | Presence in CT logs (e.g., crt.sh) is mandatory for Chrome and Safari trust. |