Free SSL checker
See the certificate chain, the key, the cipher this handshake used, and whether the server still accepts TLS 1.0 or 1.1. Not an SSL Labs grade.
What this SSL check actually does
We open a TLS connection to the host (port 443 unless you specify another) and walk the certificate chain the server sent — leaf, intermediates, and any cross-signed root that came with them. Trust is judged against this server's CA store — the same class of store browsers use, not a promise that every OS will agree.
The dedicated SSL page also probes whether TLS 1.0 and 1.1 are still accepted. That is the usual reason SSL Labs caps a site at B while a modern client still negotiates 1.3. This is not Labs' four-category formula, a cipher matrix, or 24/7 expiry monitoring. For scheduled checks, use Uptime Monitoring. The main product is still the feedback widget.
What the SSL check covers
Trust and hostname
Whether Node's CA store accepts the chain, and whether CN/SAN covers this host (including a single-label wildcard).
Chain, key, signature
Each certificate in the handshake: issuer, serial, SHA-256, signature algorithm, key type and size. SHA-1/MD5 and RSA under 2048 fail.
Negotiated protocol
What this handshake spoke (typically TLS 1.3 + cipher). ALPN (h2 / http/1.1) when the server offers it.
TLS 1.0 / 1.1
Separate probes. If either is still accepted, that check fails. If this OpenSSL cannot speak 1.0/1.1, we mark it unprobed — never a false pass.
How it works
Paste a public URL
We resolve DNS and refuse localhost and private IPs.
Handshake plus version probes
One modern handshake for the chain and cipher, then short probes for 1.0–1.3, plus CAA and HSTS. Five free checks per host per day.
A score and a to-do
Fails first. The letter is the average of those checks — not an SSL Labs grade.
Frequently asked questions
Is this SSL checker free?+
Yes. Five checks per host per day. No account.
Do you store the certificate?+
No. We do not keep the certificate or the private handshake.
Why might this differ from SSL Labs?+
Labs caps the overall grade at B if TLS 1.0 or 1.1 is still accepted, and scores cipher/key-exchange from a large client matrix. We probe whether 1.0/1.1 are on and show the chain like decoder.link / SSL Shopper. We do not compute Labs' A–F formula. Our letter is our own check average.
Will you warn me before expiry?+
Not from this page. Add the site in Pintelly Uptime Monitoring for scheduled SSL checks.
Can I check any host?+
Public HTTP(S) hosts. Private networks and localhost are refused.
Other free checks
SEO checker
On-page score, headings, links, SSL, headers and the redirect chain — one HTML fetch.
Security headers
HSTS, CSP, clickjacking, cookies. Read from the live response.
Redirect checker
Hop-by-hop chain, HTTPS upgrades, 301 vs 302.
Feedback Widget
Pintelly's main product: visitors pin what is broken, with a screenshot.
A certificate is one hop. Visitors still find the rest.
The checker is free. The feedback widget is how agencies catch what is actually broken — on the page, with a screenshot.