How This SSL Checker Works
Enter a domain and this tool opens a real TLS connection to it on port 443 (or whatever port you specify) and reads back exactly what the server sends: the certificate itself, the full chain behind it, and the TLS version and cipher actually negotiated for that connection. Nothing here is guessed, cached, or simulated, it's the same handshake a real visitor's browser would get at that exact moment.
What 'Secure', 'Needs Attention', and 'Insecure' Mean
A result is Secure when the certificate is valid, trusted, covers the domain you asked about, and the server negotiated a modern TLS version. It drops to Needs Attention when nothing is actually broken yet but something is close, most often a certificate expiring within 14 days, or the server still accepting an outdated protocol version like TLS 1.0 or 1.1. It's Insecure when a real problem exists right now: an expired certificate, a hostname mismatch, a self-signed or otherwise untrusted certificate, or an incomplete chain missing an intermediate.
How This Checker Tells DV, OV, and EV Apart
Every certificate on the web is Domain Validated (DV), Organization Validated (OV), or Extended Validation (EV), depending on how much the certificate authority verified before issuing it. Rather than guess from the Subject field, this checker reads the certificate's own Certificate Policies extension for the universal policy identifiers the CA/Browser Forum requires every CA to embed specifically so relying parties can tell validation level apart without maintaining a table of each CA's own proprietary OID. When a certificate carries one of these (as virtually every current DV, OV, and EV certificate from a major CA does), the result shows the real level. For the rare older certificate that omits it, we fall back to reporting only that organization info is present, rather than claim a level we can't actually verify.
SSL vs TLS: What Your Server Actually Reports
SSL is the deprecated original protocol, TLS is what actually secures every connection made today, and 'SSL certificate' is just the name that stuck even though the certificate itself is a TLS artifact now. What matters in practice is which TLS version got negotiated: TLS 1.3 and 1.2 are current and secure, TLS 1.1 and 1.0 were formally deprecated by every major browser vendor years ago and shouldn't still be accepted, and plain SSL 2.0/3.0 has known, exploitable vulnerabilities with no place on a production server. This checker reports the version actually used for the connection it just made, not a list of everything the server might theoretically support.
Common SSL/TLS Errors, Explained
A self-signed certificate means there's no certificate authority behind it at all, fine for internal testing, a red flag on a public site. An expired certificate is exactly what it sounds like, the single most common cause of a browser's "Your connection is not private" warning. A hostname mismatch means the certificate is valid for some domain, just not the one you're checking, often a sign of a misconfigured server block or a wildcard that doesn't actually cover a subdomain. An incomplete chain happens when the server sends its own certificate but forgets the intermediate certificate linking it back to a trusted root, some browsers with that root already cached won't notice, but plenty of mobile browsers, API clients, and this checker will flag it outright.