When does this certificate expire, and is the chain complete?
Paste a hostname. Certline opens a TLS connection, reads the certificate the server actually presents, and reports in plain language: the expiry date and days remaining, who issued it, every hostname the certificate covers, and whether the server sent its intermediate.
This tool answers when you ask it. No alerts, no reminders, no scheduled checks. No account required.
What Certline checks
- Expiry dateThe exact date the certificate expires and the number of days remaining. Shown in server-local time.
- IssuerWho signed the certificate — the Certificate Authority (e.g. R3, Let's Encrypt).
- SubjectThe entity the certificate identifies — typically the domain name (CN) plus optional organization details.
- SANsEvery hostname the certificate covers. If a hostname is not in this list, the browser will reject it.
- SHA-256 fingerprintThe certificate's unique cryptographic fingerprint.
- Chain completenessWhether the server sent the full chain (leaf + intermediates). A valid certificate with a missing intermediate will break on mobile clients.
- Full chain dumpEvery certificate in the chain, for debugging mismatch or path-building issues.
How it works
01
Enter a hostname
Just the hostname — no protocol, no path. Certline connects to port 443.
02
We inspect the server's TLS handshake
Certline opens a real TLS connection using Node's
tls module and reads the peer certificate directly from the server — no caches, no proxies, no intermediaries.
03
Read the results
Expiry, issuer, SANs, fingerprint, and chain completeness displayed in plain language. If the server omitted an intermediate, you will see it.
What it is not
- Not a monitoring tool. No alerts, reminders, digests, or scheduled re-checks. Certline answers when you ask it.
- Not a compliance scanner. Does not claim adherence to any standard or audit regime.
- Not a host enumerator. Checks only the hostname you type. Never scans ranges or subdomains.
- Not a replacement for your browser. Certline shows what the server presented. A browser may accept or reject the same certificate for reasons outside the certificate itself (trust store, revocation, policy).
Architecture note: Certificate inspection happens server-side using Node's built-in
tls module — no external API, no third-party service. The inspection runs on a dedicated droplet; we do not proxy TLS data through a Cloudflare Worker because Workers lack access to peer certificate data. If a host cannot be reached (DNS failure, connection refused, timeout), the tool reports that plainly and does not describe the failure as a finding about your server. No data is stored.