HEXSSL Checker analyzes the SSL/TLS certificate for the specified domain. The tool retrieves the certificate directly from the server and verifies its:

• Common Name (CN) and Subject Alternative Names (SAN),
• issuer (CA),
• validity dates (from / to),
• remaining days until expiration,
• signature algorithm (e.g. SHA256-RSA, ECDSA),
• completeness of the certificate chain (CA Chain),
• OCSP status (whether the certificate has been revoked).

Yes. HEXSSL Checker supports all X.509 certificate types, including:

• DV (Domain Validation),
• OV (Organization Validation),
• EV (Extended Validation),
• Wildcard and Multi-Domain (SAN).

It works with any server that supports port 443 and the TLS protocol.

The data is retrieved directly from the server the domain points to, using a standard TLS connection. HEXSSL does not use external databases – the analysis is performed “live”, ensuring the results are always up to date.

• OK – the certificate was successfully verified through the OCSP service (it has not been revoked).
• None – the server does not provide OCSP status (not all certificates or server configurations support this).

A missing status does not indicate an error – it simply means there is no real-time validation data available.

Every SSL certificate should include a full trust chain (all intermediate certificates). “Incomplete” means the server does not provide the full chain, and browsers may consider it untrusted. In such cases, reinstalling the certificate with the full CA bundle is recommended.

Yes. After checking the domain, you can click “Download PDF Report” to receive a professional PDF document containing:

• all certificate data,
• chain and OCSP status,
• algorithm and validity information.

The report is generated locally and can be used as technical or audit documentation.

No. All analyses are performed dynamically at the user’s request and are not saved in any database. HEXSSL Checker operates fully securely and complies with privacy best practices.

It is recommended to perform verification at least once a month or after any server configuration changes, especially if you use automatic renewals (ACME, Let’s Encrypt). You can also use our SSL Expiry Monitor tool, which automatically tracks certificate expiration dates.

This means that the TLS connection could not be established. The most common causes are:

• the server is not listening on port 443,
• the domain does not point to an active host,
• the connection is blocked by a firewall or WAF.

It is also worth checking whether the domain has a correct A/AAAA DNS record.

All types of certificates – from DV to EV – are available at HEXSSL.PL. The PDF report also includes a “Buy SSL Certificate” button that leads directly to the store.