SSL Certificate Checker

When to reach for this tool

Reach for this when you need to inspect TLS certificate expiry and validity during setup, debugging, or an incident review. A one-off check is useful for diagnosis, but production systems need continuous monitoring once the immediate question is answered.

• Confirm the issuer and the full list of covered hostnames.
• Note the renewal date so a continuous check can warn you early.
• A wildcard or multi-domain certificate can cover more hosts than you expect.

What to look for in a certificate

A certificate check answers more than "is it valid." Read four things. The expiry date tells you how long you have — and whether auto-renewal is actually working. The issuer (the certificate authority) confirms the certificate came from where you expect, not a misconfigured or unexpected source. The Subject Alternative Names list every hostname the certificate covers; a wildcard like *.example.com covers subdomains but not the apex, a common gap. And the chain must be complete — a valid leaf certificate with a missing intermediate still fails in many clients. Once you have confirmed these, the ongoing risk is simply time, which is why a one-off inspection should turn into a scheduled SSL certificate check that warns you before the expiry date.

• Expiry date — and whether automated renewal is keeping ahead of it.
• Issuer / CA — that it matches what you expect.
• Covered hostnames (SANs) — including wildcard and apex gaps.
• A complete chain — a missing intermediate breaks many clients.

From one-off check to continuous monitor

Use the certificate result to verify the issuer, the hostnames it covers, and how soon it renews before you add a continuous SSL certificate check on that host.

• Recreate the same check in Sandglass on an interval so the next change is caught without re-running the lookup.
• Send failures to email, a Slack webhook channel, or a generic webhook owned by whoever fixes the problem.
• Track the result over time instead of treating one manual reading as the final answer.

Why a lookup is not monitoring

A certificate that is valid today can expire on a weekend when nobody is watching. A one-time check tells you the current state; only a scheduled check warns you ahead of the expiry date.