What gets checked
This tool connects to the host you enter on the given port (443 by default), reads the TLS certificate it presents, and shows the details that actually matter day to day: when it expires, who issued it, and whether the hostname you checked is actually covered by the certificate's Subject Alternative Names. A certificate can be perfectly valid and unexpired and still cause a browser warning if it simply doesn't list the hostname being visited.
Before connecting anywhere, the target hostname is resolved and checked to make sure it isn't a private or internal address — this tool is for checking certificates on public servers, not for probing internal networks.
Reading the expiry window
Most automated certificate renewal (Let's Encrypt via certbot, for example) kicks in around 30 days before expiry and retries regularly after that, so a "days remaining" number in that range is usually nothing to worry about on a properly automated setup. A certificate that's manually managed, or expiring in under two weeks with no renewal visible, is worth checking on directly — DNS propagation and CA validation steps can occasionally take longer than expected.
Frequently asked questions
Why does a certificate need to list the hostname in its SAN?
Browsers check the Subject Alternative Name field against the hostname you're connecting to. If it isn't listed, the browser refuses the connection with a name-mismatch warning, even if the certificate is otherwise valid.
How much warning should I have before a certificate expires?
Automated renewal typically kicks in around 30 days out. A manually managed certificate is worth flagging at least 2 weeks before expiry.
Does this check the full certificate chain?
This reads the leaf certificate's own details — expiry, issuer, SAN list. It doesn't currently validate the full chain up to a trusted root.