Toolkit
SSL Certificate Checker
Expiry, issuer, chain validity, hostname coverage and TLS version. The two failures that take sites down are an expired certificate and an incomplete chain, and both are visible here before a customer finds them.
Opens a TLS connection and reads what the server presents, which is what every browser does before rendering a page. Nothing is probed or stored.
The failure that catches everyone
An incomplete chain is the one worth understanding, because it does not look broken to the person who deployed it. Your server sends its certificate but omits the intermediate that links it to a trusted root. Browsers that have seen that intermediate before, usually including yours, fill in the gap from cache and render the site normally.
A first-time visitor on a different device gets a warning. So the report is that the site is fine for everyone in the office and broken for a customer, which sounds impossible and is entirely routine. This checker validates the chain exactly as presented, so it sees what the customer sees rather than what your browser remembers.