How to use SSL Certificate Checker
The SSL Checker connects to a server over HTTPS and inspects its TLS certificate, reporting the issuer, validity dates, days remaining until expiry, the covered hostnames and the full chain of trust. An expired or mis-issued certificate triggers alarming browser warnings that drive visitors away instantly, so monitoring expiry and chain validity is essential. Use this tool to confirm a freshly installed certificate is complete, to catch one that is about to expire, or to verify that a site covers the exact hostname your visitors use.
- Enter the domain or hostname to inspect (port 443 is assumed).
- Click Check to retrieve and validate the live TLS certificate.
- Review the issuer, validity period and days remaining.
- Confirm the certificate covers the hostname and the chain is complete.
- Renew or reinstall before expiry and re-check to confirm the fix.
What makes a certificate valid
A browser trusts a certificate only when several conditions all hold: it is within its validity dates, the hostname matches one of the names it covers, and it chains up through valid intermediate certificates to a root the browser already trusts. A frequent real-world failure is an incomplete chain — the leaf certificate is fine but the server forgot to send the intermediate, so some clients reject it. This checker reports each link so you can tell an expiry problem from a chain problem and fix the right thing.
Staying ahead of expiry
Certificates are increasingly short-lived; many now last only 90 days, so manual renewal is error-prone and automated renewal with a tool like certbot is strongly recommended. Even with automation, monitoring matters because renewals silently fail when a validation challenge breaks. Checking the days-remaining value regularly, or wiring an alert when it drops below a threshold such as 14 days, prevents the classic outage where a certificate lapses over a weekend and the whole site starts throwing security warnings.
| Issuer type | Typical validity |
|---|---|
| Let's Encrypt | 90 days |
| Commercial DV/OV | 1 year |
| Internal / private CA | Varies |
Glossary
- TLS certificate
- A digital document that proves a server’s identity and enables encrypted HTTPS.
- Certificate chain
- The sequence of certificates linking a server’s leaf to a trusted root.
- Intermediate certificate
- A CA certificate that bridges the leaf and the root in the chain.
- SAN
- Subject Alternative Name — the list of hostnames a certificate covers.
- Certificate authority
- An organisation that issues and vouches for TLS certificates.
Related reading
Frequently Asked Questions
Why use SSL Certificate Checker?
- Confirm a TLS certificate is valid and see the exact days remaining before expiry
- Verify the certificate covers the exact hostname visitors use including subdomains
- Inspect the full chain of trust to catch a missing intermediate certificate
- Identify expiring certificates before they trigger browser security warnings
Common use cases
- Confirm a freshly issued certificate is installed and covers all required hostnames
- Check days remaining to prevent a certificate lapse over a weekend or holiday
- Debug why users see a security warning caused by a missing intermediate certificate
- Verify a wildcard certificate covers a new subdomain before routing traffic to it
- Check a third-party API endpoint's certificate validity before integrating with it
Get weekly tool tips & updates
New tools, power-user tips, and productivity hacks — delivered free every Friday.
No spam, ever. Unsubscribe with one click.
Related Network & DNS
HTTP Headers Checker
View HTTP response headers for any URL. Check status codes, security headers, caching, redirects, and server details instantly. Free and private.
Redirect Checker
Trace the full redirect chain of any URL. See every 301, 302, 307 redirect hop, final destination, and HTTP status codes.
SSL Certificate Decoder
Decode SSL/TLS PEM certificates to inspect subject, issuer, SANs, validity dates, key metadata, and fingerprints for faster troubleshooting.
CSR Decoder
Decode and inspect Certificate Signing Requests (CSR). View subject details, public key size, and algorithm from PEM CSR.
TLS Version Checker
Check which TLS protocol versions a server supports, from legacy TLS 1.0 and 1.1 to modern TLS 1.2 and 1.3. A free TLS version checker that runs a real handshake.
CAA Record Lookup
Look up CAA (Certification Authority Authorization) records for any domain. See which certificate authorities are allowed to issue SSL certificates.
Explore all Network & DNS.