OneWebDesk

TLS / Certificates

SSL certificates, TLS configuration and error diagnostics.

The tools in the TLS / Certificates category help you quickly check when an HTTPS site's SSL certificate expires, whether the intermediate chain is complete, and whether every domain you serve is listed in the certificate's SAN (Subject Alternative Names). They also cover checking which TLS versions a server supports (1.2/1.3), reviewing CAA records that restrict which certificate authorities may issue for your domain, decoding browser certificate errors such as NET::ERR_CERT_DATE_INVALID or SEC_ERROR_UNKNOWN_ISSUER, and decoding CSRs (Certificate Signing Requests). They're useful for site owners, backend and infrastructure engineers, and anyone searching for how to check SSL certificate expiry or diagnose an SSL error.

A typical workflow starts with expiry and chain. Confirm the certificate isn't about to expire, verify the trust chain is complete up to a trusted root, and make sure the hostname you connect to appears in the SAN. From there, tighten security by checking the negotiated TLS version and your CAA records. If a browser shows an error, paste the exact error code into a decoder to narrow the cause (expired, name mismatch, missing intermediate, or self-signed), then fix that specific issue. Before requesting a new certificate, use a CSR decoder to confirm the domain and organization details are correct so you don't issue the wrong cert.

Frequently asked questions

How do I check when an SSL certificate expires?
Enter a domain and the tool reads the server certificate's Not After date and shows the days remaining. Plan renewals at least 30 days before expiry, and even with auto-renewal it's worth confirming via the expiry date that the new certificate was actually deployed.
What does an incomplete certificate chain mean?
If the server sends only the leaf certificate without the intermediate(s), some browsers and many mobile or server-side clients can't build a complete trust chain and will error. Desktop browsers may look fine because of cached intermediates, so use a chain checker to confirm the intermediates are actually being served.
What's the difference between SAN and CN?
Certificates once relied on a single CN (Common Name), but modern browsers validate only the SAN (Subject Alternative Names) list. If the hostname you visit isn't in the SAN you get a name-mismatch error, so for multi-domain or wildcard certificates make sure every required host is listed in the SAN.
Is the domain information I enter into these tools safe?
Client-only tools (such as CSR and error-code decoders) run entirely in your browser and send nothing externally. Only tools that need live lookups (certificate or TLS checks) connect to the domain you enter to perform a public handshake, and none of them handle sensitive material like private keys.