SSL Certificate Checker
Enter a hostname to see the certificate it actually serves: who issued it, when it expires, whether it covers the name you typed, and whether the chain validates. The padlock in your browser collapses all of that into one icon — this shows you the parts it hides.
Port 443 only. We open one TLS connection, read the certificate and close it — no page is requested and nothing is stored.
What the four checks mean
Expiry
The single most common cause of a broken site. Certificates now last a maximum of about a year, and the industry is moving shorter still, so anything not renewed automatically will eventually be renewed too late. Under thirty days is worth acting on; under seven is an outage with a date on it.
Hostname match
A certificate is issued for specific names, listed in the Subject Alternative Name extension. If you
typed example.com and the certificate only covers www.example.com, browsers
will refuse it even though the certificate itself is perfectly valid. Wildcards cover exactly one label:
*.example.com matches shop.example.com but not
a.b.example.com, which surprises people regularly.
Chain of trust
Your certificate is signed by an intermediate, which is signed by a root your device already trusts.
Servers must send the intermediate; roots are already installed. The classic failure is a certificate
that works in your browser but fails on a phone or in curl — that is almost always a missing
intermediate, because desktop browsers quietly fetch the missing link and other clients do not.
Signature and key
SHA-256 with a 2048-bit RSA key or a 256-bit elliptic curve key is the ordinary modern setup. SHA-1 has been rejected by browsers for years, and RSA below 2048 bits with it.
What this check can’t tell you
- Nothing about protocol versions or cipher suites. A server can present a flawless certificate over TLS 1.0 with weak ciphers. That is a separate question and this tool does not answer it — a server can pass here and still be badly configured.
- Port 443 only. Not configurable, deliberately. Accepting a port list would turn this into a port scanner wearing a certificate checker’s clothes, which is exactly the abuse our port scanner was rewritten to remove.
- No redirects are followed. You get the certificate on the hostname you typed. If the site redirects elsewhere, check that hostname separately.
- Revocation is not checked. A certificate can be valid, unexpired, correctly chained and still revoked. OCSP and CRL checking is a different mechanism and is not covered here.
- Trust is judged against our server’s root store, not your device’s. They agree the vast majority of the time, but a certificate issued by an internal corporate authority will show as untrusted here while working perfectly on a managed laptop.
Only public hosts can be checked. The hostname is resolved first and the connection is made
to that address, so anything pointing at a private or internal range — 127.0.0.1,
10.x, 192.168.x, 169.254.x — is refused. That is what stops the
tool being used to probe networks it has no business reaching.
Common failures and what causes them
| Symptom | Usual cause |
|---|---|
| Works in Chrome, fails in curl or on a phone | Missing intermediate certificate. Browsers paper over it, other clients do not. |
| Expired | Automatic renewal stopped working weeks ago and nobody was watching the expiry date. |
| Name mismatch on the apex domain | Certificate covers www. only. Add the
bare domain to the SAN list. |
| Untrusted issuer | Self-signed, or issued by an internal authority that public clients have never heard of. |
| Valid certificate, browser still complains | Often mixed content or an unrelated TLS configuration problem rather than the certificate itself. |
A certificate is one layer. These cover the others.
DNS Propagation DMARC Checker WHOIS LookupFrequently asked questions
How often do certificates expire now?
Maximum lifetimes have been falling for years and continue to fall. Ninety-day certificates from automated issuers are common, and the direction of travel is shorter still — which makes automated renewal a requirement rather than a convenience.
Is a paid certificate more secure than a free one?
No. The encryption is identical. What you can pay for is organisation validation, which puts a verified company name in the certificate, and a warranty most people never claim. For encrypting traffic, a free automated certificate is the same strength.
What is a wildcard certificate?
One issued for *.example.com, covering every single-label subdomain. Convenient, but one
private key then secures everything, so a compromise is correspondingly broader.
Why does the certificate list names I do not recognise?
Shared hosting and CDNs often put many customers on one certificate, so the SAN list can be long and full of strangers. It is not a security problem in itself, though it does reveal who you share a host with.