SSL certificate checker
Expiry, issuer, the names it covers, the chain, the protocol and the cipher — and plain sentences about anything that is wrong.
How to read this
The incomplete chain, and why browsers hide it
A certificate is trusted because a chain leads from it up to a root your device already trusts. The server must send the intermediate certificates that form the middle of that chain. Many do not — and it usually still works, because browsers quietly fetch the missing pieces or reuse ones they have seen before. Other clients do not: payment gateways, mail servers, Java applications, older phones and most command-line tools will simply refuse. That is the failure that gets reported as "the website works but the API does not", and it is invisible from a browser.
Expiry is a date, not a warning
Nothing notifies you. A certificate that lapses on a Friday takes the site down until someone notices. Automatic renewal solves it, but only if the renewal is actually running — the common failure is a cron job that stopped months ago and a certificate that has been quietly renewing right up until it did not. Two weeks of remaining life is the point at which this stops being a diary note and becomes a task.
The name has to match
A certificate is issued for specific names, listed in its subject alternative names. A certificate for example.com does not cover www.example.com unless www is listed too, and a wildcard for *.example.com covers one level of subdomain, not two. Browsers check this strictly and fail closed, which is why a name mismatch produces the full-page warning rather than a padlock with a mark against it.
Doing this for a business rather than for yourself? Web Hosting.
The other tools
Subnet Calculator
Ranges, masks and host counts for IPv4 and IPv6. Runs entirely in your browser — nothing you type is sent anywhere.
DNS Lookup
The same question asked of eight public resolvers at once, so you can see where a change has propagated and where it has not.
IP Lookup
What an address is, what it is for, which registry it was allocated to, and what it calls itself in reverse DNS.