SSL Expiry Checker

How this reads your output

Every PEM block in what you paste is decoded, then the chain is checked for the two things servers get wrong. Order first: each certificate should name the next one as its issuer, and a chain sent out of order works in some clients and fails in others. Then completeness: the leaf plus every intermediate should be present, and the root should not be, since the client already has it and sending it wastes bytes on every handshake. Add a line reading "host: example.com" and the hostname is checked against the alternative names too.

What the results mean

Chain order

Whether each certificate is issued by the next. Broken order is the classic works-in-my-browser fault, because browsers often repair it and other clients do not.

Root included

A self-signed authority certificate in the chain. Harmless but unnecessary: it adds bytes to every handshake and the client trusts its own copy, not yours.

Certificates pasted

One usually means a missing intermediate, which is the single most common TLS misconfiguration and the one that fails silently in browsers.

Common problems and fixes

The site works in a browser but fails from curl or a mobile app

A missing intermediate, almost certainly. Browsers can often fetch it themselves using the authority information access extension, and most other clients cannot, so the failure appears only outside the browser. Concatenate the leaf and every intermediate into one file in that order and serve them together.

The certificate is valid but the connection is still refused

Check the dates on the intermediates rather than just the leaf. An expired intermediate breaks the chain exactly as an expired leaf does, and it is easy to miss because the certificate you renewed is fine. Beyond that, look at the TLS versions and ciphers the server accepts, which are configuration rather than certificate problems.

Frequently asked questions

More in DevOps

• X.509 Certificate DecoderDecode a PEM certificate and read every field it carries.
• JWT DecoderDecode a JWT to read its header and claims — safely, in your browser.
• HAR File AnalyserFind where a page load actually spent its time, not just which request was slowest.