Which port is checked?

Always port 443 (HTTPS) with TLS from the start. For STARTTLS on port 25 there is the SMTP Test; for IMAP, POP3 and Submission a separate tool is planned.

What does 'not trusted' mean?

The certificate chain cannot be traced back to a public root certification authority, or the host name does not match, or the certificate is expired or not yet valid. A browser would block the connection with a warning.

My certificate is expired, what now?

Reissue and replace the full chain, then reload the service. If the automatic renewal (for example Let's Encrypt) did not take, fix the cause: the renew job must run regularly and the ACME validation must be reachable.

Error 'host name does not match', what causes that?

The requested name is not listed as a Subject Alternative Name in the certificate and is not covered by any wildcard either. Request a certificate that contains all names actually in use as SANs.

Why is the cipher suite shown but not graded?

Which cipher is negotiated depends on the client's preference list. This tool shows what a modern standard client gets, it does not try all combinations systematically like SSL Labs.

Is an IP address accepted as input?

Yes, the field takes an FQDN or an IP address (the same validation as the DNS Lookup). For an IP without a matching SAN, the host name check will fail as expected.

Certificate Check

Check a host's TLS certificate: trust chain, validity, version, cipher.

A TLS certificate proves a server's identity and provides the key for the encrypted connection. If it is expired, issued for a different name or signed by no known certification authority, browsers and HTTPS clients abort the connection with a warning. For mail servers with web interfaces (webmail, Autodiscover, OWA) this directly leads to unreachable services.

What this tool checks

It opens a real TLS connection to the given host on port 443, without a STARTTLS preamble. It checks the trust chain against the public CA bundle, the expiry date and whether the given name is covered by the certificate (Subject Alternative Name, wildcard-capable). It also reports the negotiated TLS version, the cipher suite, key type and key length of the certificate and the signature algorithm. If the trust check fails, a second, purely informational connection attempt still fetches the certificate details.

Reading the result

Green means: chain trusted, not expired, host name covered, TLS 1.2 or higher. Unlike the SMTP Test on port 25 (opportunistic TLS), an untrusted or expired certificate is an error here, because a browser then does not open the page. Warnings appear for TLS below 1.2, for RSA keys below 2048 bit and for a signature algorithm using SHA-1 or MD5. A remaining validity of only a few days appears as a warning so the renewal is not missed.

Background

The structure and validation of X.509 certificates is governed by RFC 5280, the matching of host names to certificates (SAN over Common Name) by RFC 6125 and RFC 9525. TLS 1.2 is described in RFC 5246, TLS 1.3 in RFC 8446; the older versions SSL 3, TLS 1.0 and TLS 1.1 are considered obsolete (RFC 8996). This tool does not rate the cipher suite systematically like SSL Labs, it shows what a modern standard client negotiates.

Common problems and how to fix them

Certificate expired. Renew and replace the complete chain (leaf plus intermediate certificates). With Let's Encrypt, check why the automatic renewal did not run (cron, port 80 reachable, webroot path).
Host name does not match. The requested name is neither a SAN nor covered by a matching wildcard in the certificate. Issue a certificate that lists all names in use as SANs, or move the service to the name the certificate is valid for. The Common Name alone has not been enough for years.
Unknown certification authority. Almost always the intermediate certificate is missing from the served chain. Include the full chain file provided by the issuer, in the order leaf, then intermediate.
Self-signed. For publicly reachable services, use a certificate from a recognised CA (free via Let's Encrypt). Self-signed certificates are only tolerable for closed, manually distributed environments.
Old TLS version or weak signature. On the server, disable TLS 1.0 and 1.1, offer at least TLS 1.2 and use a certificate with a SHA-256 signature and an RSA key of at least 2048 bit or an ECDSA key.

Common questions

Which port is checked?: Always port 443 (HTTPS) with TLS from the start. For STARTTLS on port 25 there is the SMTP Test; for IMAP, POP3 and Submission a separate tool is planned.
What does 'not trusted' mean?: The certificate chain cannot be traced back to a public root certification authority, or the host name does not match, or the certificate is expired or not yet valid. A browser would block the connection with a warning.
My certificate is expired, what now?: Reissue and replace the full chain, then reload the service. If the automatic renewal (for example Let's Encrypt) did not take, fix the cause: the renew job must run regularly and the ACME validation must be reachable.
Error 'host name does not match', what causes that?: The requested name is not listed as a Subject Alternative Name in the certificate and is not covered by any wildcard either. Request a certificate that contains all names actually in use as SANs.
Why is the cipher suite shown but not graded?: Which cipher is negotiated depends on the client's preference list. This tool shows what a modern standard client gets, it does not try all combinations systematically like SSL Labs.
Is an IP address accepted as input?: Yes, the field takes an FQDN or an IP address (the same validation as the DNS Lookup). For an IP without a matching SAN, the host name check will fail as expected.