SSL Checker Validator🔒 100% local
Static sanity checks on a hostname or certificate: syntax, wildcards, expiry format — no network request. Privacy-first, no server uploads, no tracking.
Related Tools
This tool never connects to the host you name. It takes the text in the box, strips a leading http:// or https:// and everything from the first slash onwards, then runs three string tests on what is left: whether the hostname matches the RFC 1123 label pattern, whether it is a bare IPv4 address, and whether the last dot-separated label is at least two alphabetic characters. It closes by listing what a real certificate inspection covers and printing an openssl command for you to run yourself.
How to use it
- Paste a hostname such as example.com; an http(s):// prefix and any path are removed for you.
- Press Process to see the three static checks with a tick or a cross beside each one.
- Read the pass count on the Result line, then copy the openssl command below it and run it somewhere with network access.
- Use the checklist in the middle to see what the static pass does not cover.
Worked example
example.combecomesHost: example.com
== Static analysis (no network requests — your input never leaves this tab) ==
✓ Valid hostname syntax
RFC 1123: alphanumeric labels, hyphens not at start/end, at least one dot.
✓ Not a bare IP address
Hostname present — SNI certificates work.
✓ TLD looks valid
TLD ".com" is a plausible top-level domain.
== What a full SSL check verifies (run these via your browser or CLI) ==
• Certificate validity period (notBefore ≤ now ≤ notAfter)
• Chain of trust up to a root CA in the browser trust store
• SAN entries include the exact hostname (or wildcard *.domain)
• Protocol TLS 1.2+ (TLS 1.3 preferred)
• Strong cipher suites, no RC4/3DES
• OCSP stapling + HSTS header (https://host via curl -sI https://host | grep -i strict)
CLI: openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -dates -subject
Result: 3/3 static checks passed.
Tip: also check www.example.com — browsers expect both SANs on one cert.Every line above is produced from the string alone; no DNS query and no TLS handshake happened while it was generated.
10.0.0.1becomesResult: 1/3 static checks passed.Only the last line shown here. A bare IPv4 address fails the 'not a bare IP' check and the TLD check, so one of three passes.
When to use it
- Catching a typo in a hostname - a trailing hyphen, a missing dot, a stray path - before running a real certificate check.
- Working out whether a name is even eligible for an SNI certificate, since a bare IP is flagged.
- Showing a colleague the exact openssl invocation that reproduces a full inspection of a certificate chain.
What it does not do
- It cannot tell you whether a certificate exists, is current, or matches the host. It never fetches one, so a well-formed hostname that does not resolve passes all three checks.
- Only dotted-quad IPv4 is recognised as an address. An IPv6 literal such as ::1 fails the syntax check and is scored as a bad TLD as well.
- The TLD detail sentence is chosen by string length alone, so a failing check can still be described approvingly: ::1 is shown with a cross next to the text TLD '.::1' is a plausible top-level domain.
- Certificate expiry, wildcard matching and SAN coverage are only described in the checklist - there is no box to paste a certificate into.