Certificate Checker

The Certificate Checker analyzes a domain's TLS/SSL certificate by performing a remote fetch of the certificate chain or by parsing a provided PEM/DER file. It resolves a host and port (default 443) and retrieves the leaf certificate along with intermediates. Example: input domain example.com with port 443. The tool then builds a structured report that highlights the certificate's identity, validity window, and chain connectivity. If multiple SANs exist, the list is included and validated against the hostname; when a PEM/DER file is provided, structure and fields are validated prior to extraction.
Core outputs include issuer, subject, valid_from, valid_to, and the list of Subject Alternative Names (SANs). It also reports key_size, public_key_algorithm, and signature_algorithm, plus chain_valid (true/false) and chain_status. Additional checks cover expiry in days, supported TLS versions, and whether OCSP availability or revocation status information is provided. Outputs are presented in a machine-readable JSON alongside a concise human-readable summary. It also computes a lightweight risk score based on days to expiry, key algorithm strength, and chain completeness. It also estimates remaining certificate lifetime risk buckets (low/medium/high) and produces a score to help prioritization.
Target users are security engineers, DevOps teams, and IT security auditors who need accurate certificate data for onboarding, renewal planning, incident response, and compliance. The tool differentiates itself by performing end-to-end chain validation against trusted roots, flagging hostname mismatches, detecting missing intermediates, and surfacing common misconfigurations. It supports both remote fetch and file-based inputs for flexibility and automation. In practice, teams integrate the tool into deployment pipelines and audit workflows to ensure continual certificate hygiene.
Error handling and edge cases include domain resolution failures, timeouts, incomplete certificate chains, self-signed certificates, deprecated algorithms, and network unavailability. In these scenarios, the tool returns explicit status flags, explanatory notes, and recommended next steps. Timestamps are expressed in UTC and outputs are suitable for automated pipelines or manual review. The tool flags deprecated hash algorithms (such as SHA-1) and oversize validity gaps.