SSL checker
Test any site's SSL/TLS certificate the way a strict client does: expiry, hostname coverage, full chain of trust, TLS version and cipher. Flags missing intermediates that browsers hide.
The badssl.com examples show what each kind of failure looks like.
The chain of trust, and why "it works in my browser" misleads
Your certificate is signed by an intermediate CA, which is signed by a root CA that operating systems and browsers ship with. The server must send the intermediate along with its own certificate. Toggle it off and see which clients cope:
The server sends its leaf certificate plus the intermediate. The client checks each signature up the chain until it reaches a root it already trusts in its store. Valid.
Check from the command line
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null: the full chain and handshake.echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates -subject -ext subjectAltName: just dates and names.curl -vI https://example.com: what a strict client sees.
Paste any of that output into the output explainer if it's not clear. Also check which CAs are allowed to issue for your domain with the CAA lookup.
Questions people ask
What does an SSL checker test?
What does "unable to get local issuer certificate" mean?
fullchain.pem for Let's Encrypt), not just the leaf certificate. The explainer on this page shows why browsers may still accept it.Why does it say hostname mismatch?
example.com doesn't cover www.example.com unless both are in the SAN list; a wildcard *.example.com covers one level only (not example.com itself, nor a.b.example.com).