hostnag

Check an SSL certificate's expiry, chain and hostname

Paste a host to see its certificate's days left, chain and hostname match. It runs once with a 10 second cap, the same runner a monitor uses; the result says where it ran.

Pick a protocol for a server that upgrades to TLS after a plain hello; the port follows unless you change it.

How to read this

Days left
How many days remain before the certificate expires, judged against the same thresholds a monitor uses.
Chain
Whether the chain validates all the way to a trusted root.
Hostname match
Whether the certificate covers the host you asked about.

Questions

Is this a scan?

No. It makes one TLS connection to the host and port you name, the same as any client would.

Why is a private address refused?

A check from the internet can say nothing useful about a private or loopback address, and hostnag never dials into anyone's network on purpose.

Related

Certificate monitoringEvery certificate hostnag can reach is watched for expiry, a swapped chain and a renewal that should already have happened; the ones it cannot reach get a URL to report to instead.

Read

How to monitor SSL certificate expiry (and why 30 days is the wrong first alert)An expired certificate breaks browsers, APIs and mail at midnight. Why one 30-day reminder fails a 90-day certificate, and what to check beyond the date.Certificate transparency explained: the public logs and the certificate you did not orderEvery public certificate for your domain is in the transparency logs. How to tell yours from one you did not order, and what to do about it.How to monitor private PKI, client, code-signing and S/MIME certificates that no scanner can reachInternal CA, client, code-signing and S/MIME certificates are served on no port. Post or paste them to a report URL for the same expiry ladder.

Watch this for good.

Start free