Verify SSL certificate details
Go deeper
The calculator gives you the number. These SnoopTool guides explain the method, the assumptions and the decision — with worked examples, data tables and FAQs.
Browse all SnoopTool guides →| Field | Meaning | What to watch |
|---|---|---|
| Subject CN | The primary hostname | Cosmetic now — browsers read the SAN list instead |
| SAN (Subject Alternative Name) | Every hostname the certificate is valid for | A certificate for example.com does not cover www.example.com unless the SAN says so |
| Issuer | The certificate authority that signed it | Let’s Encrypt, Google Trust Services, DigiCert, Sectigo |
| Not Before / Not After | The validity window | Public TLS certificates are capped at 398 days |
| Signature algorithm | How it was signed | SHA-256 or better; SHA-1 has not been trusted for years |
| Key type and size | RSA 2048+ or ECDSA P-256 | Anything smaller is obsolete |
| Chain | Leaf, intermediate, root | A missing intermediate is the classic server misconfiguration |
| Browser says | Real cause | Fix |
|---|---|---|
| NET::ERR_CERT_DATE_INVALID | Expired, or the server clock is wrong | Renew; check NTP if the certificate looks current |
| NET::ERR_CERT_COMMON_NAME_INVALID | The hostname is not in the SAN list | Reissue including every hostname you serve, www included |
| NET::ERR_CERT_AUTHORITY_INVALID | Self-signed, or the intermediate is missing | Serve the full chain: leaf then intermediate, in that order |
| ERR_SSL_VERSION_OR_CIPHER_MISMATCH | Server offers only protocols the browser refuses | Enable TLS 1.2 and 1.3; disable TLS 1.0 and 1.1 |
| Mixed content warning | The page is HTTPS but loads an HTTP asset | Fix the asset URLs; a certificate change will not help |
The check reports: valid to 2027-01-14, issuer Let’s Encrypt, SAN = example.com. The browser still refuses https://www.example.com.
Not expired, so it is not a date problem.
The issuer is trusted, so it is not an authority problem.
The SAN list contains example.com and nothing else.
www.example.com is a different hostname, and it is not covered.
Reissue with both names in the SAN list. The certificate was never wrong — it was never asked to cover www.
It proves the connection is encrypted and that whoever controls the certificate controls the domain. It says nothing about whether the business behind it is honest. A domain-validated certificate is free and issued in seconds, so scam sites have them too. Domain age and registration details are better evidence.
Domain Validated proves control of the domain and nothing more. Organisation Validated adds a check of the legal entity, which appears in the certificate details. Extended Validation is a stricter version of the same. Browsers stopped showing the green company name for EV years ago, so the practical difference to a visitor is now close to zero.
Older devices carry an older root store. If the chain depends on a root added recently, or on a cross-signed path the device does not know, it fails there and nowhere else. Serving the longer cross-signed chain usually fixes it.
No. One certificate can list many hostnames in its SAN field, and a wildcard certificate covers every direct subdomain of a name. A wildcard does not cover the apex unless the apex is also listed, and it does not cover deeper levels.
Any TLS inspection tool will report the issuer, the validity window, the SAN list and the chain. What matters is testing the exact hostname a visitor types, including the www form, because that is the name that has to be in the SAN list.
Lookups on this page query public registry and DNS data. Nothing about the domain you type is stored, and the domain owner is not notified.
Questions this lookup answers in full, with the reference tables.
For teams, not just visitors
We build WHOIS, RDAP, DNS, SSL and IP lookups as embeddable widgets or a plain JSON API in your branding, wired to your own lead form — the same checks, your colours, your domain, your leads. Tell us what you need and we will send back a working demo.
Thanks — we have it, and you will get a reply from a person within one business day. Meanwhile every tool on SnoopTool stays free, with no signup.