SSL certificate checker
Enter a domain to see whether its certificate is trusted, covers the name and when it expires, plus the issuer, TLS version, key strength and the full chain the server sends.
- Checks trust, name and expiry
- Shows TLS version and the full chain
- No signup needed
Certificate status
Enter a domain to start
- DomainWaiting for inputThe name you entered
- Server—Port 443 over TLS
- Certificate—Who it was issued to
- Trust—Chain to a trusted root
SSL certificate report
Enter a domain above to see the full report: trust, names covered, expiry, issuer, validation type, key, TLS version, cipher and the certificate chain.
Fair-use limit: 30 checks per hour and 150 per day for each visitor IP address.
What makes a certificate valid
A padlock needs more than an unexpired certificate. Browsers check four things on every visit.
Trusted issuer, current dates, matching name
The certificate must be signed by a certificate authority the browser trusts, be inside its valid-from and valid-until dates, and list the exact domain being visited. Fail any one and visitors see a full-page warning.
The chain connects your certificate to a root
Your certificate is signed by an intermediate, and the intermediate by a root stored in the browser. The server has to send the intermediate. When it does not, some browsers recover and many apps do not.
The connection matters as much as the certificate
TLS 1.3 and 1.2 are current. TLS 1.0 and 1.1 have been removed from browsers, and a weak key or SHA-1 signature is rejected even on a valid certificate.
Lifetimes keep getting shorter
Public certificates issued since March 15, 2026 last at most 200 days, falling to 100 days in 2027 and 47 days in 2029. Manual renewal no longer works; automatic renewal does.
Common SSL problems and how to fix them
What visitors see, why it happens and the fix that usually works.
| Problem | What visitors see | Usual cause | Fix |
|---|---|---|---|
| Expired certificate | A full-page warning such as NET::ERR_CERT_DATE_INVALID. | The renewal did not run, or the new certificate was not installed. | Renew it and set up automatic renewal, for example with Certbot or your host's panel. |
| Name mismatch | A warning that the certificate belongs to another site. | The certificate does not list this exact name, often www or the bare domain. | Reissue the certificate with both names, or redirect the missing one. |
| Incomplete chain | Works in some browsers, fails in others and in apps. | The server sends your certificate without the intermediate. | Install the full chain file from your CA, usually called fullchain. |
| Self-signed | A warning that the issuer is not trusted. | The certificate was made on the server instead of by a public CA. | Use a free certificate from Let's Encrypt or your host. |
| Weak key or SHA-1 | Blocked or flagged by modern browsers. | An RSA key under 2048 bits or a SHA-1 signature. | Reissue with RSA 2048+ or ECDSA P-256 and SHA-256. |
| Old TLS version | Some visitors cannot connect at all. | The server only offers TLS 1.0 or 1.1, which browsers have removed. | Enable TLS 1.2 and 1.3 in the server or CDN settings. |
How this tool works
What happens between entering a domain and seeing the report.
The domain is checked
We remove https://, paths and ports, convert international names, and look up every IPv4 and IPv6 address. If any of them is private or reserved, the check stops.
Our server connects on port 443
We open a TLS connection to the first public IP address, sending the domain name with SNI as a browser would. Connecting to the checked IP means DNS cannot be switched in between.
The certificate is verified
The same connection is checked against the Mozilla list of trusted certificate authorities that ships with WordPress, and the certificate names are compared with the domain.
Details are read
We read the names covered, dates, issuer, validation type, key, signature, the TLS version and cipher agreed, and every certificate in the chain the server sent.
You get the report
The result goes straight to your browser and is not saved or cached, so a renewed certificate shows up as soon as it is installed.
What this tool does, and what it doesn't
A plain list, so you know exactly what to expect.
This tool does
- Check trust against the Mozilla CA list
- Check that the certificate covers the domain
- Show the expiry date and days left
- Show the TLS version, cipher and key strength
- List every certificate in the chain sent
- Link to SSL Labs for a full server test
This tool does not
- Test every TLS version and cipher the server allows
- Check revocation (OCSP or CRL)
- Find mixed content on your pages
- Check ports other than 443
- Check private or internal servers
- Store the domains you check
Where your data goes
Our server looks up the domain in DNS and opens a TLS connection to it on port 443. The website sees a connection from our server, not from you. No third-party service is involved, unless you choose the SSL Labs link, which opens their site with the domain filled in. The domain and the result are not stored or cached. Like any website, our server may keep normal access logs, as described in our privacy policy.
Want the full background? Read the SSL certificate guide by Bhavin J. Sheth.
Why your results might look unexpected
The six surprises people ask about most, and what each one means.
Valid here, "Not Secure" in the browser
The certificate is fine but the page loads some files over http. Fix the mixed content and the warning goes away.
A different certificate than you expected
A CDN, load balancer or IPv6 server may answer instead of your origin. We check the first public address the domain resolves to.
Chain incomplete, yet Chrome shows no error
Some browsers download the missing intermediate themselves. Firefox, Android apps and API clients often do not, so fix it anyway.
Expires soon even though renewal is automatic
Most tools renew 30 days before expiry or after two thirds of the lifetime. If the date does not move after that, check the renewal logs.
Could not connect
Port 443 is closed, the site only works on http, or a firewall blocks servers like ours. Open https:// in your browser to compare.
www works but the bare domain fails
The certificate covers only one of the two names. Add both to the certificate, or redirect one to the other.
Questions about SSL certificates
How do I check if an SSL certificate is expired?
Enter the domain and select Check SSL. The report shows the exact expiry date and time in UTC, how many days are left, and whether browsers will still trust the certificate. A certificate also fails if it is not valid yet, which happens when a server clock or a renewal is set up wrongly.
My certificate is valid but the browser says "Not Secure". Why?
Usually the page loads images, scripts or styles over http:// instead of https://, which is called mixed content. The certificate is fine, but the page is not fully encrypted. Open your browser's developer console to see which files are loaded over http and change them to https.
What is a certificate chain and why does it matter?
Your certificate is signed by an intermediate certificate, which is signed by a root certificate that browsers trust. The server must send the intermediate along with your certificate. If it is missing, some browsers and apps show an error even though the certificate itself is valid.
How long are SSL certificates valid now?
Industry rules have shortened certificate lifetimes. Public certificates issued from March 15, 2026 can be valid for at most 200 days, falling to 100 days from March 15, 2027 and 47 days from March 15, 2029. Let's Encrypt certificates last 90 days today, and Let's Encrypt plans to move to 45 days by February 2028. Automatic renewal matters more than ever.
What is the difference between SSL and TLS?
TLS replaced SSL many years ago, and every SSL version is now obsolete and insecure. Websites today use TLS 1.2 or TLS 1.3. The name "SSL certificate" stuck, but the same certificate is used for TLS connections.
Does SSL affect Google rankings?
Google has said that HTTPS is a lightweight ranking signal. The bigger effect is on visitors: browsers label http pages as not secure, and an expired or wrong certificate shows a full-page warning that most people will not click through.
Is the domain I check stored?
No. Our server connects to the domain, reads the certificate and sends the result to your browser. The domain and the result are not saved or cached. A hashed, temporary copy of your IP address is used for rate limiting and expires within 24 hours. Like any website, our server may keep normal access logs, as described in our privacy policy.