hostnag

Check an SSL certificate's expiry, chain and hostname

Paste a host to see its certificate's days left, chain and hostname match. It runs once from US East with a 10 second cap, the same runner a monitor uses.

Pick a protocol for a server that upgrades to TLS after a plain hello; the port follows unless you change it.

How to read this

Days left
How many days remain before the certificate expires, judged against the same thresholds a monitor uses.
Chain
Whether the chain validates all the way to a trusted root.
Hostname match
Whether the certificate actually covers the host you asked about.

Questions

Is this a scan?

No. It makes one TLS connection to the host and port you name, the same as any client would.

Why is a private address refused?

Private and loopback addresses are refused: a check from outside your network can say nothing useful about them, and hostnag never dials into anyone's network on purpose.

Related

Certificate monitoringEvery certificate hostnag can reach is watched for expiry and a swapped chain; the ones it cannot reach get a URL to report to instead.

Read

How to monitor SSL certificate expiry (and why 30 days is the wrong first alert)What an expired certificate breaks, why a 30-day alert is a renewal that already failed, what to check beyond the date, and how to watch every port.Certificate transparency explained: the public logs, crt.sh, and the certificate you did not orderWhat the certificate transparency logs are, how crt.sh reads them, why a certificate you did not order matters, and how a daily watch on your domain catches it.How to monitor private PKI, client, code-signing and S/MIME certificates that no scanner can reachInternal CA, client, code-signing and S/MIME certificates are served on no port: post or paste them to a report URL and get the same expiry ladder.

Watch this for good.

Start free