Help Centre

Getting started

Certscan is a tool that opens a real TLS connection to a server and tells you what certificate that server actually presents. No account, no sign-up, no stored data — just paste a hostname and read the verdict.

Go to the check page. The page has one input — a hostname. No scheme (https://), no path (/page.html), just a plain address like github.com or api.example.com.
Type or paste the hostname and click "Check". Certscan opens a TLS connection to port 443 on that hostname and reads the certificate chain the server sends. There is no cache — the answer is always live from the server itself.
Read the verdict. The result shows: expiry date and days remaining, who issued the certificate, every hostname the certificate covers (Subject Alternative Names), and the number of certificates in the chain. If the chain is incomplete (leaf only, missing intermediates), that is flagged clearly.
Share or inspect further. The URL updates with your hostname so you can forward the link. Below the verdict, the full chain is shown with serial number, fingerprint, and validity window for each certificate.

Frequently asked questions

What exactly does Certscan check?

Certscan opens a real TLS 1.2+ connection to the hostname you provide on port 443. It reads every certificate the server sends — the leaf (your server's certificate), any intermediate certificates, and the root (if included). It then reports:

Expiry date and days remaining (or "EXPIRED" if past)
Who issued the certificate (the CA name)
Every hostname the certificate covers (SANs)
How many certificates the server sent — and whether that chain is complete
Full raw details: serial number, SHA-256 fingerprint, validity window

Why do you check the chain, not just the expiry date?

Expiry is what most checkers look at, but the failure that costs a weekend is the one nobody checks: a server that sends the leaf certificate without its intermediate chain. Desktop browsers paper over missing intermediates from their own cache, and the site works fine — until a mobile client, API consumer, or automated tool tries to connect and fails because it cannot validate the chain. That failure has nothing to do with expiry and everything to do with completeness. Certscan flags both.

I got "Incomplete chain — only leaf certificate sent". What does that mean and how do I fix it?

It means your web server is sending only its own certificate, not the intermediate certificate(s) that link it to a trusted root. Most certificate authorities (Let's Encrypt, DigiCert, Sectigo, etc.) provide a "chain" or "full-chain" file when you issue a certificate. You need to configure your server to serve that full chain. The fix depends on your server software:

Nginx: The ssl_certificate directive should point to a file containing the leaf and intermediates concatenated (leaf first, then intermediates).
Apache: The SSLCertificateChainFile directive (or SSLCertificateFile with the full chain) should include intermediates.
Caddy: Typically handles this automatically; if the chain is incomplete, check that the CA's intermediate is available.
Cloudflare / reverse proxy: If your origin server is behind a proxy, the proxy — not the origin — should serve the full chain. Certscan sees whatever the edge server sends.

After updating your configuration, run another check to confirm the chain is now complete.

The check failed — "Connection refused", "Timeout", or "No route to host". Why?

Certscan opens a TCP connection to port 443 on the hostname you entered. If that fails, the server is not accepting TLS connections on port 443 from our IP address. Common causes:

The hostname resolves to an IP that does not accept HTTPS traffic on port 443.
A firewall, security group, or network ACL is blocking inbound connections from Certscan's IP range.
The hostname itself may be a subdomain with no A/AAAA record, or DNS resolution fails.
The server may be behind Cloudflare (see the known limitation below).

Certscan reports the specific error message returned by the system. You can use that message to diagnose further.

Can Certscan check hosts behind Cloudflare?

No. A host behind Cloudflare cannot be reached from Certscan's backend. Cloudflare proxies inbound traffic and does not allow direct TLS inspection from this tool's infrastructure. The limitation is at the platform level — it is not a problem with your server. You will see an error if you try. For hosts not behind Cloudflare, the check works normally.

Does Certscan offer alerts or reminders when a certificate is about to expire?

No. Certscan does not offer email alerts, push notifications, scheduled re-checks, or any form of proactive notification. There is no mailbox in this fleet, and the tool is designed to answer when you ask it — nothing more. If you need reminders, we recommend setting a calendar reminder for the expiry date the tool reports.

Is my hostname stored or logged?

No. Certscan uses the hostname only to open the TLS connection. It is never stored in a database, written to a log, cached, or shared. The result is displayed in your browser during your session and discarded. Your hostname disappears after the check completes.

Is Certscan really free? Are there usage limits?

Yes — Certscan is completely free. No account, no sign-up, no credit card, no usage caps. There is nothing to subscribe to, nothing to upgrade from, and nothing to cancel. If paid tiers are introduced in the future, they will be announced on the pricing page. At present, you can run as many checks as you like.

Known limitations

Certscan is an honest tool with honest gaps. These limitations are by design or by platform constraint — they are not bugs that will be fixed.

Cloudflare hosts cannot be checked. The backend cannot establish a direct TLS connection to any server behind Cloudflare's proxy. This is a platform limitation, not a finding about your server. The caveat is stated next to the input on every page.
No alerts, reminders, or scheduled re-checks. There is no email sender in this fleet. Certscan answers when you ask it and does not contact you again. Set your own calendar reminder.
No subdomain enumeration or range scanning. Certscan checks exactly one hostname — the one you type. It does not scan subdomains, IP ranges, or adjacent hosts.
Port 443 only. Certscan checks TLS on the standard HTTPS port. It does not support custom ports or non-TLS services.
No compliance or certification claims. Certscan does not assert compliance with PCI, SOC 2, HIPAA, or any other regime. The certificate report is informational — it is not a substitute for a professional security audit.
No mailbox is available. There is no email address on any domain run by this fleet. Contact details cannot be provided until the owner supplies them. See "How to contact us" below.
No legal entity is registered. Certscan is operated without a registered legal entity. Terms, privacy, and billing sections are placeholders until the owner supplies registration details.

How to contact us

Certscan does not yet have a mailbox or contact form. No email address exists on any domain in this fleet, and publishing an unreachable address would be worse than publishing none.

What to do if you need help with something not covered here:

If the FAQ above does not answer your question, the issue is either a bug in the tool or a request that needs the owner's attention. At present, the best path is:

Check the pricing page and the terms for current status and disclaimers.
If you believe the tool has a genuine bug, a needs.md record is kept by the operator. This page will be updated when a contact route is established.

This page will be updated when the owner supplies a mailbox, contact form, or other support channel. An honest gap is preferred to an unreachable address.

No mailbox is yet available. A support contact address and any required legal registration details will be published here when the owner supplies them. Do not attempt to send mail to any address on certscan.agen2ic.ai — no mailbox exists to receive it.