hollop.net

SSL check for web and mail servers

Enter a server and see which certificates it really sends: does the name match, is the chain complete, and do older Android devices trust it too?

Detects missing intermediatesChecks Android 13 and olderHTTPS, SMTP, IMAP, POP3 and more
Try it:

Enter a host name and click “Check”.

For the check, the hollop.net server opens a TLS connection to the host you entered and reads the certificates. Nothing is stored. Internal and private addresses are not checked.

What the SSL check tests

A browser only tells you whether the connection works. While doing so it quietly fills in missing intermediates and uses its own, up-to-date certificate store. Apps, mail clients, Java, curl and older phones do not. The SSL check shows the chain exactly as your server sends it.

Server certificate

It checks the host name against the SAN field (including wildcards like *.example.com), start and end of validity, key length and signature algorithm. With less than 30 days left you get a notice.

Intermediates and order

The server must send its own certificate and all intermediates up to just below the root CA, in the order server → intermediate → next intermediate. If a link is missing, the site often still works in a browser, but apps and mail clients report “unable to get local issuer certificate”. The root CA itself does not have to be sent.

The problem with older Android devices

Newer root CAs such as GlobalSign Root R46, ISRG Root X2 or the DigiCert G5 roots are only in the system certificate store from Android 14 (October 2023) on. Android 13 and earlier do not know them. A root CA sent by the server is never accepted as trusted, so adding it does not help.

The fix is a cross certificate: the same CA with the same key, but vouched for by an older root that old devices know too. If the server sends this cross certificate, old devices find their way to the old root and new devices still go to the new one. The SSL check detects the problem, and with one click the certificate converter adds the matching cross certificate from the Mozilla CCADB to your chain.

Mail servers and STARTTLS

For SMTP (ports 25 and 587), IMAP (143) and POP3 (110) the check first connects in plain text and then switches to TLS with STARTTLS, just like a mail client. Ports with direct TLS such as 465, 993 and 995 are encrypted right away.

Revocation, CAA and DANE

The check also queries the certificate’s revocation status via OCSP or the CA’s revocation list (CRL). It reads the domain’s CAA record and warns if the current issuer is not allowed there, because the next renewal would then fail. If there is a TLSA record (DANE) for the port, it checks whether it matches the certificate served and is protected by DNSSEC. You can create such records with CAA & DANE.

Fixing the chain

  1. Run the SSL check and click “Fix in the converter” or “Complete chain in the converter”.
  2. The converter takes over the chain, fetches missing intermediates via AIA and offers matching cross certificates.
  3. Add the private key and export the format your server needs, e.g. a PEM bundle for nginx or PFX for IIS.
  4. Install it on the server, reload and check again here.

FAQ

Why does my site work in the browser but not in the app?

Browsers often fetch missing intermediates themselves. Apps, Java, curl and many mail clients do not and abort. The SSL check shows whether your server sends the complete chain.

Do I have to send the root CA?

No. Clients only trust the root CA in their own store. Sending the root does no harm, but costs a few hundred bytes on every handshake.

Why does Android 13 reject my certificate?

Your chain probably ends at a root CA that is only in the store from Android 14 on, such as GlobalSign Root R46. A cross certificate that vouches for the same CA under an older root fixes this. The converter adds it.

Can I check mail servers too?

Yes. Pick the port, e.g. 587 or 25 for SMTP with STARTTLS, 465 for SMTPS, 993 for IMAPS or 143 for IMAP with STARTTLS.

What is stored?

Nothing. The server opens the connection, hands the certificates to your browser and forgets them. To prevent abuse, the number of checks per time is limited.