SSL / TLS check
Certificate validity, chain, hostname match and which TLS versions the server accepts.
Frequently asked questions
Why does my browser warn even though the certificate is valid?
Usually the server does not send its intermediate certificate, so some clients cannot build the chain to a trusted root. Check the 'Chain is complete' result and install the full chain on the server.
Should TLS 1.0 and 1.1 be disabled?
Yes. Both are deprecated and rejected by modern browsers. Keep TLS 1.2 and 1.3 enabled.
How early should I renew a certificate?
Renew at least 30 days before expiry. Certificates from Let's Encrypt and similar CAs last 90 days or less and should be renewed automatically.
Tools
DNS propagation checkerQuery resolvers around the world and the zone's authoritative nameservers in one go, and see on the map where your change has arrived.PingRound-trip time and packet loss from our server. Use TCP mode when a host drops ICMP.TracerouteThe path packets take from our server to the target, hop by hop, with the network (ASN) each router belongs to.Port checkIs a TCP port reachable from the internet? Test a server, or your own connection to confirm port forwarding.HTTP headersFollow the redirect chain, see response headers and timing, and grade the security headers.WHOIS lookupRegistration details for a domain or the owner of an IP range, straight from the registry's WHOIS servers.Mail & blacklistMX, SPF, DMARC and DKIM for a domain, plus a check of its mail servers against public DNS blocklists.Subnet calculatorEnter an address with a prefix or a mask, for example 192.168.10.37/26 or 10.0.0.1 255.255.240.0.What is my IP?This is the address websites see when you connect to them.