Skip to content
All tools

Certificate Hostname Checker

Find out whether a certificate actually covers the names people will type, using the same rules browsers use, and get a plain explanation when it does not.

Certificate

Paste the server certificate or upload a .pem/.crt/.cer/.der file. If you paste a whole chain, the first certificate is checked.

One per line. URLs, ports and trailing dots are fine; IP addresses are checked against IP SANs.

Equivalent OpenSSL command

openssl x509 -in certificate.pem -noout -subject -ext subjectAltName
openssl verify -verify_hostname www.example.com -partial_chain -trusted certificate.pem certificate.pem

The first line lists the names the certificate carries. The second checks one name with OpenSSL's own matching rules, trusting the certificate itself so only the hostname check can fail.

How a client matches a hostname

After the chain validates, the client compares the hostname it connected to against the names inside the certificate. Modern clients look only at the Subject Alternative Name extension. DNS names are compared case-insensitively, label by label. A wildcard is allowed only as the entire left-most label, it matches exactly one label, and it never matches the bare domain. IP addresses must appear as IP SANs, not as text in a DNS entry. This tool applies those rules and reports which SAN matched, or why none did.

Typical reasons for a name mismatch

  • The certificate was issued for example.com only, and users type www.example.com, or the other way round.
  • A wildcard is expected to cover the apex domain or a deeper subdomain, and it cannot.
  • The service is reached by IP address or by a short internal name that was never added as a SAN.
  • A load balancer or reverse proxy is serving a default certificate because the request did not carry Server Name Indication for this hostname.
  • The certificate predates the SAN requirement and only carries a common name.

Checking the live server instead of a file

Switch to the live-server option and enter the hostname. The certificate the server really presents is fetched for you and the hostname is pre-filled in the list, so one click shows whether the names line up. Add any other names the same server answers on, internal ones included, to check them against the same certificate.

Frequently asked questions

Runs entirely in your browser. Certificates, keys and passwords you enter here are processed locally with JavaScript and are never uploaded or sent to any server — nothing is stored, logged or transmitted.