Free tools

Use these tools to investigate one certificate before setting up recurring monitoring. They are useful for diagnosis and validation, but a one-time check is not a substitute for scheduled monitoring.

Check a live endpoint

CertWatch's free certificate checker connects to a hostname and port without an account. It reports certificate dates, issuer, chain validity, and other handshake details. Use it to confirm the target and SNI behavior before adding an endpoint to an account.

Decode a certificate or CSR

The certificate and CSR decoder parses PEM data in your browser. It shows subjects, issuers, validity windows, SANs, public-key details, and signature information. The certificate is not uploaded by the tool.

Inspect locally with OpenSSL

For a local view of the certificate presented with the correct SNI:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -dates -issuer -subject -ext subjectAltName

Replace the hostname and port as needed. Local output depends on the network path and the OpenSSL version; compare it with the public checker when a proxy, load balancer, or CDN may be involved.

From diagnosis to monitoring

1. Use the checker to confirm what the public endpoint presents now.
2. Use the decoder or OpenSSL when you need to inspect PEM details or SANs.
3. Fix the renewal, chain, routing, or deployment problem if the result is unexpected.
4. Add the endpoint to CertWatch so the check repeats and alerts you before the next deadline.