Check an SSL certificate on any host. This SSL certificate checker reads the chain exactly as your server sends it, with no silent repairs. It then tells you what is wrong, why it matters, and how to fix it.

Why a site can pass in your browser and fail everywhere else

A server is supposed to send its own certificate and the intermediate that issued it. When it sends only the leaf, most browsers paper over the gap: they have often cached that intermediate from another site, and they will quietly download it using the Authority Information Access extension inside the certificate. The page loads, the padlock appears, and nothing looks wrong.

Software that generally does neither: curl and openssl, API clients and SDKs, Java and .NET applications, Linux servers, embedded devices, load balancers and API gateways. Those fail intermittently, often only in production, and usually with an error that blames the client.

This checker reports what your server actually sent. Then, separately, it fetches the missing certificate itself to work out whether an incomplete chain is the only thing wrong, which is the difference between "add one file to your bundle" and "your certificate is not trusted".

The error this usually shows up as

If you arrived here after seeing one of these, an incomplete chain is the most likely cause:

SSL certificate problem: unable to get local issuer certificate: curl
unable to verify the first certificate: Node.js
PKIX path building failed: Java
Peer failed to perform TLS handshake: GnuTLS clients
NET::ERR_CERT_AUTHORITY_INVALID: Chrome and Edge
self signed certificate in certificate chain: Node.js and npm
certificate verify failed: unable to get local issuer certificate: Python

All of them mean the same thing: the client could not build a path from the certificate it was given to a root it trusts, and unlike a browser it would not go and fetch the missing piece.

That error has two opposite causes, though, and the fix for one makes the other worse, so it is worth knowing which you have before changing anything on the server. Unable to get local issuer certificate, which of the two you have works through telling them apart.

What it checks

Trust chain: complete, incomplete, or untrusted, and where it breaks
Expiration: how long you have, and when to start worrying
Hostname: whether the certificate really covers the name you asked for
Certificate: key size and algorithm
Protocols: which TLS versions are accepted, including ones that should not be
Cipher: forward secrecy and whether the negotiated suite is still sound

The hostname check is deliberately kept separate from the chain check. A certificate can have a perfectly good chain and the wrong name on it, and most tools report that as a broken chain, which sends you looking in the wrong place.

SSL checker, TLS checker, certificate chain checker

SSL itself has been dead since 1999: every version of it is deprecated, and what your server actually negotiates is TLS. The old name stuck to the tooling anyway, so an SSL checker and a TLS checker are the same thing. This page reports the protocol version that was really agreed rather than the word in its own name, which is the only way to find out that a host still accepts TLS 1.0.

Certificate chain checker is the narrower name and the more accurate one for what usually goes wrong. The certificate is rarely the problem; the chain around it is. A server can hold a perfectly valid certificate and still break every non-browser client by omitting the intermediate that proves where it came from. The three names describe one job: check SSL certificate expiry, the names it covers, and the chain of trust behind it as a client with no cache would see it.