SSL Certificate Checker

Enter a domain to inspect its live TLS certificate — who issued it, exactly when it expires, every hostname it covers, the protocol negotiated, and whether browsers will actually trust it. Free, instant, no signup.

What this checks & how to fix it

The tool opens a real TLS connection to port 443 with the hostname in the SNI extension — the same thing a browser does — reads the certificate the server presents, and closes the connection without requesting a page. It then reports what OpenSSL concluded about the chain, whether the requested hostname is in the certificate's Subject Alternative Names, the validity window and days remaining, and the protocol, cipher and key type that were negotiated. The status is Valid when all of that checks out, Expiring soon under 30 days, and Expired or Not trusted otherwise, with the specific reason spelled out.

How to fix what it finds

An expired or expiring certificate is renewed at whoever issued it — on most platforms (Vercel, Netlify, Cloudflare, cPanel with AutoSSL) that is automatic and a low day count means the automation has failed. A hostname mismatch means the server is presenting a certificate for a different site, usually a default vhost catching a name it was never configured for. A broken chain is fixed by installing the intermediate certificate alongside your own. After any change, re-run this tool: it reads the live handshake, so a stale result means the fix has not been deployed yet, not that it is cached.

Frequently asked questions

What happens to my SEO if the certificate expires?

Every browser replaces your page with a full-screen warning, most visitors leave, and Googlebot — which fetches over HTTPS like a browser — starts recording errors. Rankings do not vanish the same day, but a site that stays broken for more than a few days will see pages drop out of the index. This is why the tool shows days remaining so prominently and marks anything under 30 days as expiring soon.

Why does the tool say 'Not trusted' when my browser shows a padlock?

Usually a missing intermediate certificate. Browsers quietly fetch intermediates they have seen before, which hides the problem on your machine; a strict client, or any visitor whose browser has never seen that intermediate, sees an error. The chain section shows what the server actually sent. Serve the full chain — the certificate followed by its intermediates — and the warning goes away.

The certificate is for *.example.com — does that cover example.com?

No. A wildcard covers exactly one level: shop.example.com and www.example.com, but not the bare example.com and not deep.shop.example.com. Certificates normally list the bare domain as a separate name, and the covered-names list shows every name this certificate is valid for, so you can check before pointing a new subdomain at the same server.

Why are Let's Encrypt certificates only valid for 90 days?

By design, so that a stolen key is useful for less time and so that renewal has to be automated. That automation is the point: if a 90-day certificate is close to expiry, the renewal job has stopped running, which is worth finding before it lapses. Certificate lifetimes across the industry are being reduced too — the maximum drops to 47 days by 2029 — so treat any manual renewal process as something to replace.

Which TLS version and cipher should I expect to see?

TLS 1.3 with an AES-GCM or ChaCha20 cipher is the current norm, and TLS 1.2 is still fine. Anything older — TLS 1.0 or 1.1 — has been dropped by every browser and is a finding worth fixing at the load balancer or web server. The key type shown is the certificate's own key; ECDSA P-256 and RSA 2048 are both standard today.

Related tools

HTTP Header CheckerDNS LookupDomain Age CheckerIP & Hosting Lookup

Command Palette

Search for a command to run...