Getting started
Certline checks the TLS certificate a web server is actually presenting — not just
the expiry date, but the whole chain. Here is how to use it:
- Go to the Check page.
- Enter a bare hostname — for example,
example.com. No protocol
(https://) and no path (/page).
- Click Check. Certline opens a real TLS connection to that host
on port 443, reads the certificate the server presents, and reports the results.
- Read the results: expiry date and days remaining, issuer, subject, Subject
Alternative Names (SANs), SHA-256 fingerprint, and chain completeness.
The tool supports any hostname that speaks TLS on port 443 and is reachable from the
public internet. It does not need an account, a login, or any configuration.
Frequently asked questions
1. What does "chain incomplete" mean, and why should I care?
Your server sent the leaf certificate but not the intermediate certificate(s) that
connect it to a trusted root. Desktop browsers often have the missing intermediate
cached and the page loads fine for your users on desktop. Mobile clients (iOS, Android)
do not have that cache — the connection fails, and the user sees a "cannot verify
server identity" error. This is the exact problem Certline was built to detect.
The fix is to configure your web server (Nginx, Apache, Caddy, etc.) to serve the
full chain — typically by concatenating the leaf and intermediates into a single file.
2. Certline says my site is unreachable, but I can visit it in my browser. What is wrong?
Certline opens a raw TLS connection on port 443 — it does not use a browser or an
HTTP client. Some hosts behind Cloudflare, Fastly, AWS CloudFront, or other reverse
proxies do not accept raw TLS inspection sockets from arbitrary IPs. This is a
platform limitation (the service cannot open a transparent inspection socket to those
networks), not a finding about your certificate. If your site loads in a browser,
your certificate is working for your visitors. Certline's unreachable
result means the check could not complete, not that your certificate is invalid.
3. Does Certline monitor my certificates and alert me when they expire?
No. Certline is an on-demand inspection tool — it answers when you ask it and does
nothing between checks. There is no monitoring, no expiry alerts, no email reminders,
and no scheduled re-checks. This is a deliberate design constraint: the platform has
no email sender and no alerting infrastructure. If you need expiry monitoring, you
should set up a dedicated monitoring service (many exist) or configure your certificate
authority's renewal reminders.
4. Can I check multiple hostnames at once, or use an API?
Not yet. The current tool checks one hostname per query. A
Pro tier
with API access, bulk CSV checking, and custom output formats (JSON, YAML) is planned
but not yet built or available for purchase. See the
Pricing page
for the current status of planned features.
5. What do the colour-coded expiry statuses mean?
The expiry status is shown as a colour-coded badge:
Green — more than 30 days until expiry. The certificate is in good
standing.
Amber — 30 days or fewer until expiry. Renew soon.
Red — the certificate has expired. Renew immediately.
These thresholds are fixed and not configurable. The days remaining figure is calculated
from the server's local time at the moment of the check.
6. Does Certline store the hostnames I check or any personal data?
No. The hostname you enter is sent to the backend server, which opens a TLS connection,
inspects the certificate, and returns the result. The hostname is not persisted, logged,
or stored beyond the duration of the request. No accounts, no cookies, no tracking
scripts, and no analytics services are used. See the
Privacy policy
for the full statement.
Known limitations
These are honest limitations of the current product. Some will be addressed in
future versions; others are deliberate design choices.
- No monitoring, alerts, or reminders. The tool does not watch your
certificates between checks. There is no email sender or notification system in
this platform.
- No compliance scanning. Certline does not claim adherence to any
standard, certification, or audit regime (PCI-DSS, HIPAA, SOC 2, etc.).
- No host enumeration. The tool checks only the hostname you type.
It never scans IP ranges, enumerates subdomains, or probes beyond the single
hostname you provide.
- No accounts, saved history, or server-side data. Every check is
stateless. Results disappear when you close or refresh the page.
- Proxied hosts may appear unreachable. Hosts behind Cloudflare,
Fastly, AWS CloudFront, and similar reverse proxies may not accept raw TLS
inspection sockets. This is a platform limitation, not a certificate issue.
- No API or bulk checking. The Pro tier with API access, CSV bulk
checks, and custom output formats is planned but not yet available.
- Port 443 only. Certline only checks TLS on the standard HTTPS
port. It does not support custom ports or non-HTTPS services.
- No legal entity. The business has no registered legal entity,
jurisdiction, or formal terms of service. See the Terms page
for the current status.
Contact us
Support is not yet reachable by email. The owner is aware that a contact method is
needed and will publish one when available.
In the meantime, the Frequently asked questions and
Known limitations sections above cover the most common issues.
If your question is about certificate configuration on your own server (how to fix a
broken chain, how to install an intermediate, how to renew), your certificate
authority's documentation or your web server's manual are the best resources.
Legal enquiries: A contact address for legal or privacy enquiries is
not yet available. It will be published on the
Privacy and
Terms pages when a legal entity is established.
Last updated: August 2026