Do you accept a private key?

No. The check only reads the certificate the server presents.

Does this test every cipher?

No. It reports the certificate chain and the expiry, not a full TLS configuration review.

Why might the name not match?

The certificate is for a different hostname than the one you typed, or the name is missing from the subject alternative names.

Tools · Mail, DNS and sites

SSL/TLS certificate checker

Enter a public hostname. We open a TLS connection and report the issuer, the expiry, the days left, and the certificates in the chain.

Reads the public certificate only. Do not send a private key. Nothing you type is stored.

How to use it

Enter the hostname only, or paste a URL. The port defaults to 443.
Read the days left and the issuer. A short chain often means the intermediate certificate is missing.
Renew before the expiry. Browsers and mail servers fail closed when the certificate lapses.

Questions

Do you accept a private key?: No. The check only reads the certificate the server presents.
Does this test every cipher?: No. It reports the certificate chain and the expiry, not a full TLS configuration review.
Why might the name not match?: The certificate is for a different hostname than the one you typed, or the name is missing from the subject alternative names.

An automated client can POST JSON to /api/tools/ssl-check with host. The OpenAPI document is at /api/tools, with a short guide at /llms.txt. Nothing submitted is stored.