SSL/TLS checker

What the SSL checker tests

MtrXTools connects to the server the way a browser would, reads the certificate chain it sends, and then tries each TLS version separately. Enter a hostname, a URL or host:port (for example mail.example.com:465) to test another port.

• Expiry: how many days the certificate has left.
• Hostname match: whether the name you entered is covered by the certificate's subject alternative names.
• Chain of trust: whether the chain the server sends validates against public root certificates.
• Key strength: RSA key size or the ECDSA curve.
• Protocols: which of TLS 1.0, 1.1, 1.2 and 1.3 the server accepts, and the cipher it negotiates.

Protocol and cipher details

Below the certificate, a second scan lists every cipher suite the server accepts on each protocol from SSL 3.0 to TLS 1.3, each marked safe or unsafe with the reason, on whatever port you entered. It also reads the protocol settings a server reveals during ordinary handshakes: secure renegotiation, downgrade protection, compression, ALPN, session resumption, OCSP stapling, named groups (including post-quantum ones) and DH parameters.

Known attacks such as POODLE, BEAST, CRIME, Sweet32 and Logjam are inferred from those settings. MtrXTools never sends attack traffic, so vulnerabilities that can only be found by probing (Heartbleed, ROBOT, padding oracles) are not covered. These findings don't change the A+ to F grade.

How the grade works

The grade starts at A and is capped by the worst problem. An expired certificate, a hostname mismatch or an untrusted chain gives F, because browsers show a full-page warning. Accepting TLS 1.0 caps the grade at C. Accepting TLS 1.1, or an RSA key shorter than 2048 bits, caps it at B.

A+ needs TLS 1.3, no TLS 1.0 or 1.1, and at least 14 days left on the certificate.

Fixing the common problems

• Missing intermediate certificate: serve the full chain, not just your certificate. In nginx point ssl_certificate at fullchain.pem; in Apache use SSLCertificateFile with the chain file.
• Expired or expiring: renew, then reload the web server and every load balancer or CDN that holds a copy. Automate renewal with an ACME client such as certbot or acme.sh.
• Hostname mismatch: reissue the certificate with every name visitors use, usually both example.com and www.example.com.
• Old protocols: in nginx set ssl_protocols TLSv1.2 TLSv1.3;, in Apache SSLProtocol -all +TLSv1.2 +TLSv1.3.

Certificate types in brief

• Domain-validated (DV), organisation-validated (OV) and extended-validation (EV) certificates encrypt exactly the same way. Browsers no longer show EV differently, so DV certificates from Let's Encrypt or your CDN are enough for almost every site.
• A wildcard such as *.example.com covers one level only: www.example.com and shop.example.com, but not example.com itself or a.b.example.com.
• A multi-domain (SAN) certificate lists each name it covers. The checker shows the full list, which is the quickest way to see why a name doesn't match.

Why the chain matters

Browsers trust a small set of root certificates. Your certificate is signed by an intermediate, which is signed by a root, and the server must send your certificate plus every intermediate. The root itself shouldn't be sent. When an intermediate is missing, each client either fetches it (most desktop browsers) or fails (most other software), which is why chain problems often show up only in apps, scripts and monitoring.

Questions

Why does my site work in the browser but fail here?

Browsers can download a missing intermediate certificate on their own and cache it, so a server that leaves it out can look fine in Chrome while curl, Android apps, Java and API clients fail with "unable to verify the first certificate". MtrXTools validates the chain exactly as your server sends it.

How long can a certificate be valid?

Public certificates issued from 15 March 2026 can be valid for at most 200 days. The limit drops to 100 days in March 2027 and 47 days in March 2029, so automated renewal is becoming essential. Let's Encrypt certificates last 90 days.

Can I check a mail server?

Yes for ports that start with TLS straight away, such as 465 (SMTPS), 993 (IMAPS) and 995 (POP3S). Ports that upgrade with STARTTLS, such as 25 and 587, aren't supported yet.

How do I get warned before a certificate expires?

Add the domain to the Expiry calendar for reminders 14 and 3 days before, or put a Status badge in your README.