SSL Checker: diagnosing broken certificates, not just valid ones

How JWWD built a free SSL checker that reads and explains broken certificates, so we could stop reaching for openssl on the command line.

The problem

An expired SSL certificate takes a site offline faster than almost any other fault. Browsers show warnings, visitors leave and trust drops in minutes.

We kept reaching for openssl on the command line to check certificates, because the common online checkers were slow, covered in ads or wanted a signup before telling you something as simple as when a certificate expires. Worse, many choke on exactly the broken certificates you need to diagnose.

What we built

SSL Checker connects to a domain and shows everything about its certificate in one view:

  • Certificate details: who it’s issued to, the issuer, validity dates and days remaining.
  • Coverage: every Subject Alternative Name, and whether the certificate actually covers the domain you asked about.
  • Trust: the full chain, with missing intermediates and untrusted roots flagged.
  • Protocols: which TLS versions from 1.0 to 1.3 the server accepts.

Results are graded from A+ down to F, with each issue explained.

How it's built

  • Two passes, not one: The tool connects permissively first, so it can read an expired, self-signed or mismatched certificate, then runs a strict pass to decide whether a browser would trust it. Verifying on the first connection would collapse every broken certificate into “could not connect”.
  • Legacy protocols tested properly: OpenSSL 3 refuses TLS 1.0 and 1.1 on the client side by default, which would make every server look modern. Our probes lower that level for the test only, verified against test hosts that offer a single legacy version.
  • Wildcards matched by the rules: Hostname checks follow RFC 6125, so *.example.com covers www.example.com but not example.com itself.
  • No false alarms on auto-renewing certificates: Short-lived certificates from Let’s Encrypt, Google Trust Services and ZeroSSL renew automatically, so they’re only flagged when expiry is under seven days, which usually means renewal has failed.
  • Built to stay open: Private and internal addresses are refused, results are cached for 10 minutes, and per-visitor limits plus a global ceiling stop it being abused.

Context, not just counts

SSL Checker publishes a report on the state of TLS across Australian websites, built by running the same engine against every .au domain in the Tranco top million list.

A second pass records whether each site answers from a Cloudflare edge. That matters because Cloudflare’s default minimum is TLS 1.0, so a proxied site with untouched settings accepts it no matter how modern its server is. Without that context, one vendor default would read as a national failure.

The site also carries a reference of common SSL errors and how to fix them.

The result

A free, fast certificate checker that’s most useful exactly when something is wrong, with no signup and no hidden tiers. We’ve seen sites go down over a forgotten renewal, and this is the tool we built so that’s easy to catch. See the SSL Checker tool page for a quick overview.

Have a project like this in mind? Talk to JWWD.