SSL Lookup

SSL Lookup is a free tool that retrieves an SSL/TLS certificate's validity dates, signature type and issuing-authority details for a specified host and port.

What does an SSL certificate lookup check?

It checks the certificate presented by a server when a client starts a secure connection to the selected host and port. The certificate is sent during the TLS handshake, before normal HTTPS page content is exchanged.

SSL is still widely used as a label, although current secure connections normally use TLS. Most server certificates follow the X.509 standard and bind a public key to one or more identities. For a CA-issued certificate, the certificate authority digitally signs it so that clients can verify its issuer and detect unauthorised modification as part of certificate-path validation.

How do I use SSL Lookup?

Enter the server's hostname in Host and the relevant network port in Port, then run the lookup.

1. Use a hostname such as www.example.co.uk, without a page path, query string or fragment.
2. Use the port where the secure service is listening. Port 443 is conventional for HTTPS, but another service may use a different port.
3. Compare the returned certificate details with the hostname and deployment you expected to reach.

For example, a successful lookup for www.example.co.uk on port 443 returns five labelled certificate fields. Checking the same host on port 8443 addresses a different service endpoint and may therefore return a different certificate.

Hostnames cannot contain spaces or URL paths. Dots and hyphens are normal hostname characters, while accented or non-Latin names are represented in DNS using their IDNA form, often called Punycode. An empty hostname or port does not identify an endpoint, and a TCP port must be a number from 1 to 65535. Very long names must still meet DNS limits, including a maximum of 63 octets for each label.

SSL Lookup runs on the server. Your host and port inputs travel to the server over HTTPS and are not stored.

How do I read the SSL certificate result?

Read the dates first, then use the organisation and common name fields to identify which certificate authority issued the certificate, with the signature type as supporting technical information.

These fields do not establish that the certificate is fully trusted. A complete validation also considers the Subject Alternative Names, certificate chain, issuing authority, revocation status and the client's clock. The organisation field alone is not proof of who operates a website.

Troubleshooting scenarios

• Renewal appears to have failed. If Nginx or Apache was given a new certificate but the old expiry date is returned, check that the service was reloaded and that every load-balanced server has the new files.
• A certificate warning appeared after a DNS change. Compare the returned dates and issuing authority with the certificate expected on the old and new hosting platforms. A different issuer can reveal that the hostname still resolves to the previous server.
• A CDN or proxy shows the wrong certificate. Services such as Cloudflare may terminate TLS separately from the origin server. Check the public hostname and port rather than assuming the origin certificate is the one visitors receive.

A mail service using implicit TLS on its selected port can also be checked. Services that require a protocol-specific STARTTLS command before the handshake, common for SMTP on ports 25 and 587, may not work with a generic certificate lookup. This lookup also cannot diagnose unrelated delivery faults involving MX records, SPF, DKIM, message queues or rejected recipients.

Why does an old certificate still appear after renewal?

After a renewal, an old certificate usually still appears because the web service was not reloaded, one server in a distributed deployment has not received the new files, or a CDN or load-balancer node is still presenting the previous certificate. If the renewal coincided with a DNS or hosting change, cached DNS answers can also direct the lookup to an older endpoint.

Certificates themselves do not propagate through DNS. DNS records have time-to-live values, and recursive resolvers may retain an earlier answer until that cache expires. As this lookup runs on a server, its resolver may have a different cached answer from your laptop, office network or mobile connection.

Load balancers and CDN edge locations can create a similar effect. One node may present the new certificate while another still presents the old one. Record the resolved IP addresses, repeat checks after the relevant DNS cache period, and inspect each backend or edge configuration where possible.

Frequently asked questions

Does SSL Lookup return certificate chain information?

No. The returned fields do not include the intermediate certificates, root trust path, issuer details or revocation information. Use a browser's certificate viewer or a TLS command-line client when you need to inspect the full chain.

Can it check a wildcard certificate?

Yes, the lookup retrieves whatever certificate the server presents, including a wildcard certificate for a name such as *.example.co.uk. The wildcard name itself lives in the certificate's subject fields, so it does not appear in this result's issuer-oriented fields, but the dates and signature type still describe the presented certificate. A wildcard normally matches one hostname level, so it can cover shop.example.co.uk but not checkout.shop.example.co.uk.

Can an SSL certificate identify the website owner?

No. Many certificates confirm control of a domain without naming a legal organisation. For domain registration or network ownership information, Whois Lookup and IP Lookup address different parts of the investigation.

Why does another checker show a different issue or expiry date?

X.509 validity values represent exact times, while checkers may display them in UTC or convert them to another time zone. A conversion around midnight can make the calendar date appear one day earlier or later even when the underlying timestamp is the same.

Does this tool renew or repair an expired certificate?

No. It only retrieves certificate details. Renewal must be completed through the certificate authority, hosting control panel or automated certificate client, followed by installation and a service reload where required.

Final checks

When investigating a warning, record the exact hostname, port, returned dates and issuing authority. Check DNS separately, confirm the certificate installed on each server, and use a full chain inspection if the dates look correct but browsers still report an error.