---
title: "SSL certificate checker"
description: "See who issued a site’s SSL certificate, when it expires, whether it matches the hostname and whether browsers trust the chain. Free, no sign-up."
url: "https://rookflare.com/tools/ssl-certificate-checker/"
---

# SSL certificate checker

See who issued a website’s certificate, when it expires, whether it covers the hostname and whether browsers trust it. We only read the TLS handshake. Use the form at https://rookflare.com/tools/ssl-certificate-checker/ (needs JavaScript); the API endpoint is POST /api/public/v1/tools/ssl with a JSON body { "url": "https://example.com" }.

## What you get

- Days left and the exact expiry date
- Issuer and the names the certificate covers
- Whether it matches the hostname
- Whether the chain leads to a trusted root

## What happens when a certificate expires

Nothing changes on your server, but every client that connects stops trusting it at the second it expires.

### Visitors get a full-page warning

Chrome shows “Your connection is not private” with NET::ERR_CERT_DATE_INVALID, Firefox shows “Warning: Potential Security Risk Ahead” and Safari shows “This Connection Is Not Private”. Most people turn back.

### HSTS sites cannot be opened at all

If your site sends a Strict-Transport-Security header, browsers remove the option to continue past the warning.

### APIs and webhooks fail quietly

Apps, payment callbacks and scripts that call your domain reject the TLS handshake, often with errors no person sees.

## Certificate lifetimes are getting shorter

In April 2025 the CA/Browser Forum adopted ballot SC-081, which cuts the maximum lifetime of public TLS certificates in steps. At these lengths renewal has to be automatic, and someone has to notice when the automation stops.

| Issued | Maximum lifetime | In other words |
| --- | --- | --- |
| Before March 15, 2026 | 398 days | The limit since September 2020. |
| From March 15, 2026 | 200 days | About six and a half months. |
| From March 15, 2027 | 100 days | About three months. |
| From March 15, 2029 | 47 days | Under seven weeks. |

## What this tool checks

### Issuer and validity

The certificate authority, the first and last day it is valid, and the days left.

### Hostname match

Whether the hostname you entered is listed in the certificate, including one-level wildcards such as *.example.com.

### Chain

Whether the certificate chains to a trusted root with the intermediates the server sent.

### Protocol

The TLS version the server agreed to use with us.

## How to fix common problems

### Expired or expiring certificate

Renew it with your certificate authority, or check that automatic renewal (for example certbot or your host’s ACME client) still runs and can reach its validation URL.

### Hostname mismatch

The certificate does not list this name. Add the name (often the www or non-www variant) to the certificate, or redirect to a name it covers.

### Untrusted chain

The server is not sending the intermediate certificate, or it uses a self-signed one. Install the full chain file your authority provides.

## Monitor this automatically

Every uptime check reads the certificate. On Growth and Agency you get a warning 14 days before it expires, while there is still time to fix renewal. [Start free trial](https://app.rookflare.com/register/).

## Frequently asked questions

### How early should I renew?

Automatic renewal usually starts 30 days before expiry. If fewer than 14 days are left, something has probably stopped renewing it.

### What if the site has no HTTPS?

The tool connects to port 443 of the hostname. If nothing answers with TLS there, it reports that the site has no HTTPS.

### Is this tool free?

Yes. You do not need an account. Each IP address can run 10 checks a minute and 100 a day, and a website can be checked 10 times in 10 minutes across all visitors so the tool is never used to flood a site.

### Do you store the URL or the results?

The result is kept for 10 minutes so a repeated check is instant, then it is deleted. We do not log the URLs you check or the content of the page.

## More free tools

- [Is my website down?](https://rookflare.com/tools/website-down-checker/): Status code, response time, redirects and SSL expiry.
- [Meta tag and Open Graph checker](https://rookflare.com/tools/meta-tag-checker/): Title, description, canonical and social card preview.