TLS certificate report

Enter a host name and we make one TLS handshake to it, the same one a browser makes, then check everything around the certificate: the chain it sent, whether browsers trust it and the name matches, how long it has left, which TLS versions the server still accepts, HSTS, revocation status via OCSP or CRL, the domain's CAA policy and what Certificate Transparency logs have seen. The result has a grade from A+ to F and a link you can share.

How the grade works

• F when a browser would refuse the connection: untrusted or self-signed chain, name mismatch, expired or revoked certificate, or any other error-level issue.
• B for a trusted certificate with one weakness: TLS 1.0 or 1.1 still enabled, a cipher without forward secrecy, or any warning such as a missing intermediate, a weak key or an expiry inside 30 days. Two or more of those give a D.
• A for a clean configuration that lacks one modern nicety: no TLS 1.3, no HSTS of six months or more on a web port, or a revocation status we could not confirm.
• A+ for everything in order.

Mail servers and other ports

Set the port to check SMTP (25, 465, 587), IMAP (993), POP (995) or anything else that speaks TLS directly. HSTS is only evaluated on web ports. STARTTLS upgrades on port 25 or 587 are not negotiated here; those are covered for monitored certificates.

What this report cannot see

Only hosts on the public internet can be checked here. Internal hosts, staging boxes and anything behind a VPN need CertMoni's private agent, a small script you run on a machine that can reach the ports the certificates are served on. Private network addresses are refused by this tool.