SSL/TLS check: is a site's certificate and configuration healthy?

An expired or misconfigured TLS certificate breaks HTTPS for every visitor with a full-page browser warning, and a site still accepting old, weak protocol versions or ciphers is a softer but real risk — both are easy to miss until a visitor or customer reports it.

What it will check

• The full certificate chain presented for a hostname, including whether it is complete and correctly ordered.
• Expiry date, counted down in days, so a renewal can happen before it lapses.
• Which TLS protocol versions and cipher suites the server accepts, flagging deprecated ones (TLS 1.0/1.1, weak ciphers).

Why this is not live yet

A trustworthy TLS check needs a dedicated outbound connection-testing backend that can open raw TLS sockets safely at scale and rate-limit who it connects to on a visitor’s behalf — it ships with the AdminKit Check API.

Check manually today

openssl s_client -connect example.com:443 -servername example.com </dev/null

This prints the certificate chain and the negotiated protocol/cipher. Look for Verify return code: 0 (ok) and a notAfter date far enough in the future; openssl x509 -noout -dates on the certificate output shows the dates more directly.