DNSApe | Fast Network Tools

Settings

Winter snow effect

SSL is not valid for expired.badssl.com

Certificate Validity

Validity Period

The time window during which the certificate is valid. Includes 'Valid From' (Not Before) and 'Valid To' (Not After) dates.

Good Values

Let's Encrypt: 90 days. Commercial CAs: up to 398 days (since September 2020). Expiration should be weeks/months away.

Security

Expired certificates cause browser warnings and blocked connections. Short validity periods limit exposure if keys are compromised. Monitor expiration and renew 30+ days early.

The date range during which this certificate is trusted.

Not valid before: Apr  9 00:00:00 2015 GMT
Not valid after:  Apr 12 23:59:59 2015 GMT

Certificate Chain

Certificate Chain

The complete trust path from server certificate through intermediate CAs to a trusted root CA. Each certificate is signed by the one above it.

Good Values

Complete chain: server certificate + 1-2 intermediate CAs + root CA. Root CA in browser trust store. Chain depth of 2-4 certificates is typical.

Security

Browsers verify the entire chain. Incomplete chains (missing intermediates) cause validation failures. Root CAs keep keys offline; intermediates do the signing.

The hierarchy of certificates from the server cert to the root CA.

Certificate chain
 0 s:OU=Domain Control Validated, OU=PositiveSSL Wildcard, CN=*.badssl.com
   i:C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Apr  9 00:00:00 2015 GMT; NotAfter: Apr 12 23:59:59 2015 GMT
 1 s:C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
   i:C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA384
   v:NotBefore: Feb 12 00:00:00 2014 GMT; NotAfter: Feb 11 23:59:59 2029 GMT
 2 s:C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
   i:C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
   a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA384
   v:NotBefore: May 30 10:48:38 2000 GMT; NotAfter: May 30 10:48:38 2020 GMT
---

Certificate Details

Subject & Issuer

Identifies the entity to which the certificate was issued. Contains Common Name (CN), Organization (O), and other identifying fields.

Good Values

For DV certificates, CN matches a domain in the SAN field. For OV/EV certificates, O contains a verified legal organization name (e.g., 'O=GitHub, Inc.').

Security

The Subject identifies the certificate owner. Browsers verify the domain matches either CN or SANs. Organization info adds trust but DV certificates only verify domain ownership.

Who the certificate was issued to and by whom.

Subject: OU=Domain Control Validated, OU=PositiveSSL Wildcard, CN=*.badssl.com
Issuer:  C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA

Connection Details

TLS Connection

SSL/TLS certificates are digital documents that authenticate a website's identity and enable encrypted connections. They contain a public key and identifying information, digitally signed by a trusted Certificate Authority (CA).

History

SSL was developed by Netscape in the mid-1990s. SSL 2.0 (1995) had serious vulnerabilities. SSL 3.0 (1996) was compromised by POODLE in 2014. TLS succeeded SSL: TLS 1.0 (1999), TLS 1.2 (2008), TLS 1.3 (2018, current standard). All SSL versions and TLS 1.0/1.1 are now considered insecure.

TLS version, cipher suite, and verification status.

SSL handshake has read 5003 bytes and written 459 bytes
Verification error: certificate has expired
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 5DB31AC61256169ED4790217B9FFAB7D51E2B1D4B21BD7CD6D9614B028167FE6
    Session-ID-ctx: 
    Master-Key: C17FF3DCF7BB1004CD7868661896C31852FA4D1CD1153070F2CD8FE3F3C19A954E2222031906A2253AFCDB4B1F58067F
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - ed d4 f4 e4 92 a0 d9 41-9c 98 78 a3 c9 7b b0 ce   .......A..x..{..
    0010 - e6 31 9c 28 0e 72 c6 13-a5 de b0 2f 36 e0 d4 0f   .1.(.r...../6...
    0020 - b5 d6 87 af 6f 20 a7 5f-f3 22 64 1d 73 b3 55 46   ....o ._."d.s.UF
    0030 - 8b 22 44 44 06 0c 9b 0a-89 70 aa 6d 3e 63 97 23   ."DD.....p.m>c.#
    0040 - e6 ca 91 76 28 73 27 9d-5a 2e 81 80 ba aa 22 3a   ...v(s'.Z.....":
    0050 - 39 92 e0 70 d2 3d 94 d9-61 e8 b7 56 c5 23 2e 3c   9..p.=..a..V.#.<
    0060 - 6f 34 56 8f e6 3b ab 9e-31 15 13 b2 68 d9 b3 18   o4V..;..1...h...
    0070 - 40 06 0e ab 95 b3 7b 84-75 53 c0 3a d6 f6 39 b7   @.....{.uS.:..9.
    0080 - 89 5b 00 e0 44 31 e8 b2-ad 54 16 2f d4 70 f7 3a   .[..D1...T./.p.:
    0090 - ac 59 19 10 bf c9 1f 72-90 f9 8f 08 cd 51 0f d7   .Y.....r.....Q..
    00a0 - 1b 8a 84 bb ba 09 ee 5a-c3 c3 9f d8 1a e9 64 62   .......Z......db
    00b0 - 4c 40 3f 2c a0 d7 a3 2a-ef 36 59 b2 b8 8d d0 f3   L@?,...*.6Y.....

    Start Time: 1766172119
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)

+ Full Certificate (PEM)

The base64-encoded X.509 certificate.

SSL is not valid for expired.badssl.com

Not valid before: Apr  9 00:00:00 2015 GMT
Not valid after:  Apr 12 23:59:59 2015 GMT

CONNECTED(00000003)
---
Certificate chain
 0 s:OU=Domain Control Validated, OU=PositiveSSL Wildcard, CN=*.badssl.com
   i:C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Apr  9 00:00:00 2015 GMT; NotAfter: Apr 12 23:59:59 2015 GMT
 1 s:C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
   i:C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA384
   v:NotBefore: Feb 12 00:00:00 2014 GMT; NotAfter: Feb 11 23:59:59 2029 GMT
 2 s:C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
   i:C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
   a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA384
   v:NotBefore: May 30 10:48:38 2000 GMT; NotAfter: May 30 10:48:38 2020 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFSzCCBDOgAwIBAgIQSueVSfqavj8QDxekeOFpCTANBgkqhkiG9w0BAQsFADCB
kDELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxNjA0BgNV
BAMTLUNPTU9ETyBSU0EgRG9tYWluIFZhbGlkYXRpb24gU2VjdXJlIFNlcnZlciBD
QTAeFw0xNTA0MDkwMDAwMDBaFw0xNTA0MTIyMzU5NTlaMFkxITAfBgNVBAsTGERv
bWFpbiBDb250cm9sIFZhbGlkYXRlZDEdMBsGA1UECxMUUG9zaXRpdmVTU0wgV2ls
ZGNhcmQxFTATBgNVBAMUDCouYmFkc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAMIE7PiM7gTCs9hQ1XBYzJMY61yoaEmwIrX5lZ6xKyx2PmzA
S2BMTOqytMAPgLaw+XLJhgL5XEFdEyt/ccRLvOmULlA3pmccYYz2QULFRtMWhyef
dOsKnRFSJiFzbIRMeVXk0WvoBj1IFVKtsyjbqv9u/2CVSndrOfEk0TG23U3AxPxT
uW1CrbV8/q71FdIzSOciccfCFHpsKOo3St/qbLVytH5aohbcabFXRNsKEqveww9H
dFxBIuGa+RuT5q0iBikusbpJHAwnnqP7i/dAcgCskgjZjFeEU4EFy+b+a1SYQCeF
xxC7c3DvaRhBB0VVfPlkPz0sw6l865MaTIbRyoUCAwEAAaOCAdUwggHRMB8GA1Ud
IwQYMBaAFJCvajqUWgvYkOoSVnPfQ7Q6KNrnMB0GA1UdDgQWBBSd7sF7gQs6R2lx
GH0RN5O8pRs/+zAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUE
FjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwTwYDVR0gBEgwRjA6BgsrBgEEAbIxAQIC
BzArMCkGCCsGAQUFBwIBFh1odHRwczovL3NlY3VyZS5jb21vZG8uY29tL0NQUzAI
BgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5jb21vZG9jYS5j
b20vQ09NT0RPUlNBRG9tYWluVmFsaWRhdGlvblNlY3VyZVNlcnZlckNBLmNybDCB
hQYIKwYBBQUHAQEEeTB3ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LmNvbW9kb2Nh
LmNvbS9DT01PRE9SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3J0
MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wIwYDVR0RBBww
GoIMKi5iYWRzc2wuY29tggpiYWRzc2wuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBq
evHa/wMHcnjFZqFPRkMOXxQhjHUa6zbgH6QQFezaMyV8O7UKxwE4PSf9WNnM6i1p
OXy+l+8L1gtY54x/v7NMHfO3kICmNnwUW+wHLQI+G1tjWxWrAPofOxkt3+IjEBEH
fnJ/4r+3ABuYLyw/zoWaJ4wQIghBK4o+gk783SHGVnRwpDTysUCeK1iiWQ8dSO/r
ET7BSp68ZVVtxqPv1dSWzfGuJ/ekVxQ8lEEFeouhN0fX9X3c+s5vMaKwjOrMEpsi
8TRwz311SotoKQwe6Zaoz7ASH1wq7mcvf71z81oBIgxw+s1F73hczg36TuHvzmWf
RwxPuzZEaFZcVlmtqoq8
-----END CERTIFICATE-----
subject=OU=Domain Control Validated, OU=PositiveSSL Wildcard, CN=*.badssl.com
issuer=C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
---
No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, prime256v1, 256 bits
---
SSL handshake has read 5003 bytes and written 459 bytes
Verification error: certificate has expired
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 5DB31AC61256169ED4790217B9FFAB7D51E2B1D4B21BD7CD6D9614B028167FE6
    Session-ID-ctx: 
    Master-Key: C17FF3DCF7BB1004CD7868661896C31852FA4D1CD1153070F2CD8FE3F3C19A954E2222031906A2253AFCDB4B1F58067F
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - ed d4 f4 e4 92 a0 d9 41-9c 98 78 a3 c9 7b b0 ce   .......A..x..{..
    0010 - e6 31 9c 28 0e 72 c6 13-a5 de b0 2f 36 e0 d4 0f   .1.(.r...../6...
    0020 - b5 d6 87 af 6f 20 a7 5f-f3 22 64 1d 73 b3 55 46   ....o ._."d.s.UF
    0030 - 8b 22 44 44 06 0c 9b 0a-89 70 aa 6d 3e 63 97 23   ."DD.....p.m>c.#
    0040 - e6 ca 91 76 28 73 27 9d-5a 2e 81 80 ba aa 22 3a   ...v(s'.Z.....":
    0050 - 39 92 e0 70 d2 3d 94 d9-61 e8 b7 56 c5 23 2e 3c   9..p.=..a..V.#.<
    0060 - 6f 34 56 8f e6 3b ab 9e-31 15 13 b2 68 d9 b3 18   o4V..;..1...h...
    0070 - 40 06 0e ab 95 b3 7b 84-75 53 c0 3a d6 f6 39 b7   @.....{.uS.:..9.
    0080 - 89 5b 00 e0 44 31 e8 b2-ad 54 16 2f d4 70 f7 3a   .[..D1...T./.p.:
    0090 - ac 59 19 10 bf c9 1f 72-90 f9 8f 08 cd 51 0f d7   .Y.....r.....Q..
    00a0 - 1b 8a 84 bb ba 09 ee 5a-c3 c3 9f d8 1a e9 64 62   .......Z......db
    00b0 - 4c 40 3f 2c a0 d7 a3 2a-ef 36 59 b2 b8 8d d0 f3   L@?,...*.6Y.....

    Start Time: 1766172119
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no
---

Your IP: 216.73.216.115

About DNSApe

DNSApe is a fast, no-nonsense network diagnostics toolkit built for developers, sysadmins, and security researchers.

Version History

2.0 - 2025-12-19

Complete rewrite

Rebuilt with Laravel 12, Livewire 3, and Tailwind CSS 4
Live ping monitoring with real-time Chart.js visualization
Email Security tool: SPF, DKIM, DMARC validation
REST API with JSON responses (60 req/min)
MCP server for AI assistant integration (Claude, ChatGPT, etc.)
Slack integration with /dns, /whois, /ssl slash commands
Help tooltips explaining each tool and record type
Shareable ping sessions with unique URLs
Pretty/Raw view toggle with persistent preference
Browser-based ping for client-side latency testing
Enhanced WHOIS with domain + IP info combined
Improved SSL certificate error handling
Full-width responsive layout

Version 2.1 with performance improvements and bug fixes coming soon.

1.1.3 - 2019-04-30

Moved to new infrastructure, resolving most DNS Traversal issues
Replaced RBL with SSL validation tool

1.1.2 - 2019-04-17

Fixed DNS Traversal issue causing many requests to fail

1.1.1 - 2019-04-16

Minor UI adjustments
Added links to lookups in DNS results
Updated dependencies
Increased session timeout to 1 week to eliminate 419 errors
Updated IP address display
Removed dnsape.com as default lookup

1.1 - 2019-02-15

Several UI adjustments
Dark mode setting is persistent between sessions via cookie
Added GDPR cookie banner for session cookies
Added tool to show client IP in lookup field (settings menu)
Keyboard shortcuts for tools, focusing, text size, copying URLs
Shareable lookup URLs - browser address changes with tool usage
Added links to Github repo and feature voting
Several error handling and bug fixes

1.0.7 - 2019-01-11

Fixed HTTP Headers issue with multiple HTTPS redirects

1.0.6 - 2019-01-09

HTTP Headers now forward to and display HTTPS headers
UI adjustments

1.0.5 - 2019-01-08

Dark Mode!

1.0.4 - 2019-01-07

TLD and subdomain validation fixes

1.0.3 - 2019-01-06

Updated DNS Cache host list
IP address validation improvements
Fixed progress bar bug with failed queries
UI adjustments

1.0.2 - 2019-01-05

IPWhois and Ping now work with IP addresses as well as hostnames
Several validation enhancements reduce errors for many lookups
Several UI adjustments

1.0.1 - 2019-01-04

Added Recent Updates panel
Fixed Whois search for many TLDs
Fixed DNS Traversal for many TLDs
Changed to fluid viewport width
Added Privacy Policy

1.0 - 2019-01-02

Initial release