Skip to content
Start free trial

SSL certificate checker

Read a site’s TLS certificate: who issued it, what it covers and when it runs out.

A public address such as example.com or https://example.com/pricing/.

What you get

  • Days left and the exact expiry date
  • Issuer and the names the certificate covers
  • Whether it matches the hostname
  • Whether the chain leads to a trusted root

Expiry

What happens when a certificate expires

Nothing changes on your server, but every client that connects stops trusting it at the second it expires.

Visitors get a full-page warning

Chrome shows “Your connection is not private” with NET::ERR_CERT_DATE_INVALID, Firefox shows “Warning: Potential Security Risk Ahead” and Safari shows “This Connection Is Not Private”. Most people turn back.

HSTS sites cannot be opened at all

If your site sends a Strict-Transport-Security header, browsers remove the option to continue past the warning.

APIs and webhooks fail quietly

Apps, payment callbacks and scripts that call your domain reject the TLS handshake, often with errors no person sees.

Lifetimes

Certificate lifetimes are getting shorter

In April 2025 the CA/Browser Forum adopted ballot SC-081, which cuts the maximum lifetime of public TLS certificates in steps. At these lengths renewal has to be automatic, and someone has to notice when the automation stops.

Issued Maximum lifetime In other words
Before March 15, 2026 398 days The limit since September 2020.
From March 15, 2026 200 days About six and a half months.
From March 15, 2027 100 days About three months.
From March 15, 2029 47 days Under seven weeks.

What this tool checks

  • Issuer and validity The certificate authority, the first and last day it is valid, and the days left.
  • Hostname match Whether the hostname you entered is listed in the certificate, including one-level wildcards such as *.example.com.
  • Chain Whether the certificate chains to a trusted root with the intermediates the server sent.
  • Protocol The TLS version the server agreed to use with us.

How to fix common problems

Expired or expiring certificate
Renew it with your certificate authority, or check that automatic renewal (for example certbot or your host’s ACME client) still runs and can reach its validation URL.
Hostname mismatch
The certificate does not list this name. Add the name (often the www or non-www variant) to the certificate, or redirect to a name it covers.
Untrusted chain
The server is not sending the intermediate certificate, or it uses a self-signed one. Install the full chain file your authority provides.

FAQ

Questions

Something missing here? Send us a message

How early should I renew?

Automatic renewal usually starts 30 days before expiry. If fewer than 14 days are left, something has probably stopped renewing it.

What if the site has no HTTPS?

The tool connects to port 443 of the hostname. If nothing answers with TLS there, it reports that the site has no HTTPS.

Is this tool free?

Yes. You do not need an account. Each IP address can run 10 checks a minute and 100 a day, and a website can be checked 10 times in 10 minutes across all visitors so the tool is never used to flood a site.

Do you store the URL or the results?

The result is kept for 10 minutes so a repeated check is instant, then it is deleted. We do not log the URLs you check or the content of the page.

More free tools

Start monitoring your website

Add your address, pick the pages and approve the first scan as your baseline.

Start monitoring Talk to us

Plans start at €19 per month. Prices are provisional.