01
Choose the public endpoint
Enter a domain without a URL path. Port 443 is the default; other ports must accept direct TLS.
SSL / TLS Certificates
SSL certificate checkerexpiry and certificate details
Use this SSL certificate checker after a renewal or a hostname change to inspect the certificate returned by NetworkCalc for a public host and port.
SSL certificate checker
Public hostname
Live TLS result
Enter a public hostname to begin.
Starting a check sends your hostname and port directly to NetworkCalc, which also sees your IP address. HeyUtils does not receive this lookup.
Data provider: NetworkCalc
Probe options
Enter a public hostname to begin.
Use this SSL certificate checker after a renewal or a hostname change to inspect the certificate returned by NetworkCalc for a public host and port.
The SSL checker parses the returned PEM in your browser. Compare exact validity dates, DNS names and SHA-256 fingerprints; a date or hostname match alone does not establish certificate trust.
Inspect a public TLS certificate
Inspect a deployed certificate
NetworkCalc connects to the public hostname and port and returns a certificate. No HeyUtils backend or API key is required.
Read the returned PEM
The browser extracts the subject, issuer, dates, SANs and fingerprint from the certificate itself. You can also inspect its PEM representation.
Three steps before export
02
Start the lookup
Click Check or press Ctrl/Cmd + Enter. Typing or loading the example does not contact the provider.
03
Compare and export
Read the validity dates and DNS SAN match. Editing the input disables copying and downloading until a new result completes.
Certificate details you can compare
Validity dates
See not-before, not-after and remaining days, with separate states for expired and not-yet-valid certificates.
DNS hostname matching
Match exact DNS SANs or a wildcard covering one label. A common name is not used as a fallback.
PEM and SHA-256
Inspect the certificate and its locally calculated fingerprint. Download the parsed result as JSON.
Scope of the SSL certificate checker
- Public domains only
- IP literals and reserved local names are rejected. The provider must be able to reach the selected public TLS port.
- Third-party availability
- NetworkCalc may rate-limit or become unavailable. A failed lookup produces an error, not a successful report.
- One certificate, limited scope
- No trust-chain validation, revocation check, cipher enumeration or separate TLS 1.2/1.3 probes are performed.
- One observation
- The provider chooses its network vantage point. Browser receipt time is shown; this is not continuous monitoring or a guarantee about every CDN edge.
SSL certificate checker questions
How can I check an SSL expiry date?
Enter a public hostname and run the lookup. The browser reads the validity dates from the PEM returned by NetworkCalc.
Does a matching, unexpired certificate prove trust?
No. These checks do not validate the signature chain, issuer trust or revocation status. Use a dedicated TLS audit for those questions.
Can I use another port?
Yes, if NetworkCalc can reach it and the service begins with TLS immediately. STARTTLS upgrades are not supported by this tool.
Is the hostname kept in my browser?
No. Starting a check sends the hostname and port to NetworkCalc. Local certificate files can instead be inspected with the certificate decoder.
Does the result cover every server behind a CDN?
No. Different locations or endpoints may serve different certificates. The report describes the certificate returned by this provider.
Something unexpected in the report?
Check your public certificate
Enter a public hostname and compare its certificate dates, DNS names and fingerprint.
Starting a check sends your hostname and port directly to NetworkCalc, which also sees your IP address. HeyUtils does not receive this lookup.