ForceVPS Network Tools

SSL Certificate Check: Inspect TLS, SAN, Chain, and Expiry

Run a live TLS handshake through a ForceVPS node and inspect the remote certificate, issuer chain, SNI handling, trust result, and expiration window before a website starts failing in production.

Back to diagnostics Open ticket

443 default port

TLS live handshake

SAN hostname coverage

TLS inspection

Run a TLS Certificate Check in Real Time

Enter a hostname or IP address, optionally override the port and SNI name, and the agent will open a live TLS session to inspect the certificate, chain, cipher, and trust result.

Host or IP

Port

SNI server name Leave it empty to use the hostname automatically, or override it for CDN and reverse-proxy checks.

The peer certificate summary and trust result will appear in the console on the right.

CLI

Result console

Target forcevps.com

Node Kyiv, Ukraine

Port 443

Status Pending

Days left Pending

Issuer Pending

$ lg certificate --node ua-iev --port 443 --sni forcevps.com forcevps.com Target: forcevps.com:443 SNI: forcevps.com Certificate chain, SAN, expiry, and trust status will be shown in the console...

FAQ

What does the online SSL Checker test?

The online SSL Checker establishes a real TLS connection to the specified server and checks its SSL certificate, validity period, issuer, SAN domain list, certificate chain, and trust status. The tool also displays the TLS connection parameters and negotiated cipher suite.

How can I check a website's SSL certificate online?

Enter the server's domain or IP address, specify the port, and provide an SNI hostname if necessary. A standard HTTPS website normally uses port 443, while SNI usually matches the domain name. After starting the SSL Check, the console will display the certificate details and trust verification result.

What is SNI and when should I specify it?

SNI tells the server which domain's SSL certificate it should provide during the TLS handshake. It is particularly important when multiple websites share one IP address or when a CDN or reverse proxy is used. When checking an IP address directly, enter the required domain in the SNI field.

What does an SSL certificate name mismatch mean?

A name mismatch occurs when the checked domain is not included in the certificate's CN or SAN list. For example, a certificate may cover `example.com` but not `www.example.com`. To fix the problem, reissue the certificate with all required domains or configure the server to return the correct certificate.

Why can an SSL certificate chain be untrusted?

A certificate chain may be untrusted if the server does not provide an intermediate certificate, uses a self-signed certificate, or relies on an untrusted certificate authority. The issue is often resolved by installing the complete certificate chain, such as a fullchain file instead of only the domain certificate.

How can I check when an SSL certificate expires?

The SSL Checker displays the certificate's valid-from date, expiration date, and the number of days remaining. If the certificate is close to expiration, renew it in advance and verify that automatic certificate renewal is working correctly.

Why does SSL Check return a TLS or wrong version number error?

A TLS or wrong version number error often means that TLS is not running on the specified port or that the server expects a different protocol. For example, checking a standard HTTP service on port 80 as HTTPS will fail. Other causes include an incorrect port, proxy settings, an incompatible TLS version, or a web server configuration error.