TLS / SSL certificate checker

Check certificate expiry, chain trust, hostname match and old TLS versions.

What this checks

We open a TLS connection like a browser does, read the certificate chain, and then try each protocol version separately to see which ones the server still accepts.

Expiry: certificates from Let's Encrypt last 90 days; renewal should be automatic.
Trust and hostname: the chain must reach a public CA and cover the name visitors type.
TLS 1.0/1.1 were deprecated by RFC 8996 and should be off; TLS 1.3 should be on.

Modern nginx TLS settings

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_session_tickets off;
ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;