odmin.biz
Menu

Free network tool

SSL/TLS certificate checker

Check a live SSL/TLS certificate's expiry, trust, hostname, SANs, chain, fingerprint, protocol, cipher, and ALPN with verified OpenSSL-style output.

Connected tool

Check SSL certificate expiry and live TLS details.

OpenSSL-style · TLS 1.2+ · public trust
Fresh verification requiredThe token is consumed after this single handshake, including failures.
Why is Turnstile required?

Protected HTTP requests contact the selected system from the odmin.biz Kubernetes gateway, not directly from your device's IP address. Every protected request needs a fresh challenge. Cloudflare processes the verification traffic; this application keeps no request history.

About this tool

What ssl/tls certificate checker does

Use this SSL certificate checker to inspect the live certificate served by one public TLS endpoint: validity dates, hostname and SAN coverage, issuer and chain, SHA-256 fingerprint, key details, negotiated TLS version, cipher, and ALPN. The result includes an OpenSSL s_client-style transcript while always enforcing public trust and server identity.

How it works

After fresh Turnstile and an explicit Inspect TLS click, the browser sends one public hostname or IP, one port, and the one-time token to the odmin.biz HTTP gateway. The gateway resolves through fixed DNS or validates a public IP literal, pins one checked address, attempts one TLS 1.2-or-newer handshake with public trust and server-identity verification, sends no application data, closes the socket, and returns bounded success or failure metadata for an OpenSSL-style transcript.

Common uses

When to use it

  • Check an SSL certificate expiry date and remaining validity after renewal
  • Verify that the live certificate is publicly trusted and matches the entered hostname
  • Inspect certificate subjects, issuers, SANs, validity dates, SHA-256 fingerprints, and public-key types
  • Review the peer certificate chain and copy PEM certificates
  • Confirm the negotiated TLS protocol, cipher, and ALPN from the odmin.biz gateway
  • Troubleshoot HTTPS, SMTPS, IMAPS, database TLS, or another implicit-TLS service on a custom public port

Scope

Limits to know

  • The result is one handshake attempt observed from the odmin.biz Kubernetes gateway, not from your device or every network path
  • Only publicly trusted, identity-matching TLS 1.2-or-newer services pass; failures show bounded diagnostic metadata but never enable an insecure connection
  • The result reports only the protocol and cipher negotiated by this client; a failed handshake may negotiate neither, and the tool does not scan every supported option
  • The returned chain is the bounded peer chain observed during this attempt and can differ by client capabilities; certificates shown after a failed verification are explicitly unverified
  • This performs no HTTP request, OCSP/revocation lookup, Certificate Transparency search, vulnerability scan, or application-protocol validation

Worked example

Example input and result

Enter one public TLS host and port to verify its current certificate identity and trust, then inspect the OpenSSL-style chain and negotiation transcript.

Input
www.example.com:443
Result
% openssl s_client -connect www.example.com:443 -servername www.example.com
Connecting to 93.184.216.34
CONNECTED
Verification: OK
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Verify return code: 0 (ok)

Quick answers

SSL/TLS certificate checker FAQ

How do I check when an SSL certificate expires?

Enter the public hostname and TLS port, complete Turnstile, and click Inspect TLS. A successful result shows the leaf certificate's Not Before and Not After dates, plus the issuer, SANs, fingerprint, public key, and the rest of the bounded peer chain.

Does this SSL checker verify the hostname and certificate chain?

Yes. The handshake succeeds only when the certificate identity matches the entered hostname or IP, the validity period is current, and the chain reaches a publicly trusted root. There is no unverified fallback.

Does this test every TLS version and cipher the server supports?

No. It reports the protocol, cipher, ALPN, and ephemeral-key details negotiated during one verified TLS 1.2-or-newer handshake. It is not a cipher-suite scan or SSL Labs replacement.

Does this disable certificate verification like openssl s_client can?

No. The diagnostic always requires TLS 1.2 or newer, a publicly trusted chain, and a certificate identity matching the entered hostname or IP. It has no bypass, fallback, or custom trust-anchor field.

What leaves my browser?

Only the entered host, port, and fresh Turnstile token go to the exact odmin.biz HTTP gateway. The result remains in current-tab memory, and application code does not persist or intentionally log the request or certificates.

Does it send HTTP or other application data?

No. It performs the TLS handshake, collects bounded peer certificate and negotiated-connection metadata, and closes without sending application bytes.

Why is Turnstile required?

The connection originates from shared odmin.biz Kubernetes infrastructure rather than your device IP. Every handshake requires a fresh challenge and explicit click as an abuse control.

Keep working

View every tool →
Online HTTP client & API testerImport a browser cURL or fetch request, send one bounded public HTTP request, and inspect its status, response headers, body, redirects, and timing.Online TCP port checkerCheck one public TCP port from the internet and review a safe telnet-style transcript with resolved IP, connection time, and optional server banner.DNS record lookupLook up selected DNS record types through a disclosed, fixed Cloudflare resolver path.