When does this certificate expire, and what breaks when it does?
Paste a hostname. Leafscope opens a TLS connection, reads the certificate chain the server actually presents, and reports the expiry date, issuer, every hostname covered, and whether the chain is complete on the wire.
Check a certificateWhat you get from one check
Expiry date and days remaining
When the certificate stops working — in plain English, not a raw timestamp. Days remaining or days past due.
Issuer and subject
Who issued the certificate and which organisation owns it. Every subject alternative name (SAN) the certificate covers.
Wire-only chain completeness
The server sent the leaf certificate. Did it also send the intermediates? If the chain is incomplete, browsers that have never visited this site will reject the connection — even if the certificate itself is still valid. This is the failure people lose a weekend to.
The point is the chain, not just the date
Most TLS checkers answer "is the padlock there?" Leafscope answers "when will it fail, and why."
A certificate can be valid and the site still break — the server sends the leaf without its intermediate. Browsers on desktop paper over it from cache. Mobile clients do not. That failure is invisible to anyone looking only at the expiry date.
openssl s_client -showcerts gives you the raw chain. Leafscope reads the same thing — what the server actually sends on the wire, not what a trust store appends.
About this tool
- Checks only the hostname you type. No range scans, no subdomain enumeration.
- Reports what the server actually presented. If a field is absent, the report says absent — no inference.
- A host behind Cloudflare can be reached (the inspection runs from outside Cloudflare's network), but the result reports it correctly.
- This tool answers when you ask it. No alerts, no email reminders, no scheduled re-checks.