Help Centre

Getting started

Certline checks what TLS certificate a server presents on port 443 — the standard HTTPS port. You give it a hostname, it opens a real connection, reads the certificate, and reports the findings.

1. Go to the Check a certificate page.
2. Type a bare hostname — for example github.com. Do not include https://, a trailing slash, or a port number.
3. Click Check. Certline connects to that host on port 443, reads the certificate it presents, and returns a report.
4. Read the report: the expiry date and days remaining sit at the top, followed by the chain completeness verdict, issuer, covered hostnames (SANs), and other technical details.

That is all there is. There is no account to create, nothing to configure, and no history to manage.

Frequently asked questions

• ▶ How do I check a certificate?

  Visit the Check a certificate page, type a bare hostname (like example.com) into the input field, and click the Check button. Certline connects to the server on port 443 and reads the certificate it actually presents — not one it says it has, but the one it sends over the wire.

  The report shows you the expiry date with days remaining, the issuer, every hostname covered by the certificate (from the Subject Alternative Names field), and whether the server included its intermediate certificate in the handshake.

• ▶ What is "chain completeness" and why should I care?

  When a client connects to an HTTPS server, the server sends its leaf certificate along with one or more intermediate certificates that chain up to a root CA trusted by the client. A missing intermediate is invisible to someone checking only the expiry date — but it breaks connections on mobile and fresh clients.

  Desktop browsers often cache intermediate certificates from previous visits and paper over a missing one. Mobile browsers and API clients do not — they reject the connection outright. This is the most common "my site works on my laptop but not on my phone" problem.

  Certline reports whether the server actually sent the intermediate in the handshake. If the verdict is Incomplete, the server configuration needs to be fixed — the certificate files on disk are fine, but the server is not sending the intermediate chain along with the leaf.

• ▶ My certificate expires in X days. Should I worry?

  Certline colour-codes the days-remaining number:

  • Green (>30 days): No immediate action needed, but note the date.
  • Amber (1–30 days): You should renew soon. Some CAs send renewal reminders in this window, but do not rely on that.
  • Red (0 days or expired): The certificate is expired. Renew it immediately — clients that enforce certificate validity will reject the connection.

  Certline does not send email reminders or alerts. There is no email sender in this fleet. You must track renewal dates yourself or use your CA's notification system.

• ▶ Why does Certline return an error for my hostname?

  Certline reports an error when it cannot complete the TLS handshake. Possible causes:

  • The hostname does not exist — DNS cannot resolve it. Check that you typed it correctly and that the domain is registered.
  • The server is behind Cloudflare or another reverse proxy that blocks our connection. Certline makes a direct TCP connection to the server. Cloudflare's proxied DNS mode terminates the TLS at Cloudflare's edge, not at your origin server, and Cloudflare's edge may reject non-browser TLS handshakes from unknown IPs. Certline cannot bypass this.
  • The server is down or not listening on port 443. The host may be reachable but not serving HTTPS.
  • A firewall or network policy is blocking outbound connections. This is rare but can happen for hosts inside private networks.

  When Certline cannot reach a host, the report makes this clear: the error is about connectivity, not about the certificate. The distinction matters — a failed check does not mean the certificate is bad.

• ▶ Do you store the hostnames I check? Is my data saved?

  Certline is stateless. The hostname you submit is used only to perform the TLS check during the HTTP request. It is not stored, logged, or saved beyond the duration of that request. There are no user accounts, no cookies, no tracking scripts, and no persistent storage on the server.

  Nothing survives closing the page or clearing your browser. Every check is a fresh connection — Certline does not remember you, your hostname, or the result after the report is displayed.

  Standard web server operational logs (IP address, timestamp, page visited, user agent) are retained for a limited period for troubleshooting and are not shared with third parties. See the privacy policy for details.

• ▶ Can Certline send me alerts or reminders to renew?

  No. Certline has no email sender, no notification system, and no scheduled tasks. It answers when you visit the page and submit a hostname — nothing runs when the page is closed.

  If you need renewal reminders, consider using your certificate authority's notification system or a dedicated monitoring service. Certline is a diagnostic tool, not a monitoring platform.

Known limitations

Certline is a focused tool with intentional boundaries. The following are not bugs — they are design constraints or features that have not yet been built.

• Cloudflare / reverse proxies Certline makes a direct TCP connection to the host. If the server is behind Cloudflare (proxied DNS) or another reverse proxy, the TLS handshake terminates at the proxy, not at the origin. Certline cannot reach the origin certificate and will report a connection error. This is inherent to how reverse proxies work — it is not a bug or a limitation that can be fixed.
• No email, no alerts There is no email sender or notification system in this fleet. Certline cannot send renewal reminders, digest emails, or scheduled reports. It answers only when you ask it. Pro features like API access and batch checks are planned but not yet available.
• Port 443 only Certline connects on port 443 — the standard HTTPS port. There is no option to specify a different port. Non-standard TLS services (e.g. port 8443, port 465) cannot be checked.
• One hostname at a time Certline checks exactly the hostname you type. It does not scan subdomains, CIDR ranges, or enumerate hostnames. Batch checking is a planned Pro feature.
• No API (yet) Programmatic certificate checking via API is not yet available. It is planned as a Pro feature. There is no rate limit information to publish until the API ships.
• Demo checkout only The subscription form on the Pricing page is a demonstration. No payment is processed, no account is created, and no Pro subscription is activated. The owner has not yet connected a payment processor.
• No legal entity registered The operator of this service has not yet established a registered company, legal address, or jurisdiction. The terms and privacy policy state this honestly.