Paste a hostname. Certline opens a real TLS connection, reads the certificate the server sends, and reports the expiry date, issuer, subject alternative names, and whether the chain is complete — in plain language, no dashboard.
Enter any public-facing hostname — example.com,
api.example.com, anything that speaks TLS on port 443
(or a custom port you specify). No scraping, no third-party lookup.
Our backend opens a real TLS handshake against the server you named — the same way a browser would, except we do not cache intermediates or paper over gaps. What the server sends is what we report.
Expiry date and days remaining. Issuer common name and organisation. Every SAN the certificate covers. Whether the server sent its intermediate certificate — and whether the chain is logically linked. One column, no scrolling required.
A certificate can be valid and your site still break. Many servers send only the leaf certificate without its intermediate — desktop browsers often hide this because they cache intermediates from prior visits. Mobile clients and fresh browser profiles do not.
This failure is invisible to anyone looking only at the expiry date. It is the one people lose a weekend to. A certificate that expires in six months but lacks its intermediate is already broken.
Certline reports the chain exactly as the server presented it: number of certificates sent, whether each links to the next, and whether a root was included (unusual and unnecessary). If the chain is incomplete, you know immediately.
Certline checks the hostname you provide — one at a time, on demand. It does not scan ranges, enumerate subdomains, send email alerts, or schedule recurring checks. There is no account system and no stored history. Each check is independent and returns what the server presents at that moment.