SSL Certificate Checker
Check any domain's SSL certificate instantly — see the expiry date, issuer, trust status, and full chain. Free, no login required.
How to Read Your SSL Certificate Results
Each field in the result set tells you something different about the certificate. Here is what each piece of information means and what to look for.
Issuer (CA Name)
The organization that signed and issued the certificate. Should be a well-known CA like Let's Encrypt, DigiCert, Sectigo, or GlobalSign. If the issuer and subject share the same CN and O, the certificate is self-signed — browsers will show a warning.
Subject Alternative Names
The list of domains and subdomains this certificate is valid for. For production, confirm that both the apex domain and www are present. A wildcard entry (*.example.com) covers all first-level subdomains but not the apex or second-level subdomains.
Expiry Date & Countdown
The date after which the certificate is no longer valid. The countdown bar changes from green (>30 days) to yellow (8–30 days) to red (<7 days). Let's Encrypt certificates expire every 90 days; commercial certificates typically last 1 year.
TLS Protocol Version
The TLS version your server negotiated for this connection. TLS 1.3 is the current standard — faster and more secure. TLS 1.2 is acceptable. TLS 1.0 and 1.1 are deprecated and should be disabled; SSLv3 and SSLv2 are critically vulnerable.
Serial Number
A unique identifier assigned by the CA to this specific certificate. Useful for certificate management, OCSP stapling lookups, and incident tracking when multiple certificates exist for the same domain.
SHA-256 Fingerprint
A cryptographic hash of the certificate's full content. Two identical fingerprints mean two identical certificates. Compare fingerprints before and after a certificate rotation to confirm the update was applied — or to detect unexpected certificate substitution.
Certificate Expiry Action Plan
Expiry is the most common cause of SSL outages. Use this table to know what action to take based on how many days remain.
| Days Until Expiry | Status | Recommended Action |
|---|---|---|
| > 30 days | OK | No action needed. Schedule a renewal reminder at the 30-day mark. |
| 8–30 days | Warning | Initiate renewal now. Most CAs and auto-renewal services (Let's Encrypt, Certbot) renew at 30 days. |
| 1–7 days | Urgent | Renew immediately. An expired certificate causes browser errors and blocks all HTTPS traffic. |
| 0 or negative | Expired | Certificate is expired. Replace it immediately — your site is showing security errors to all visitors. |
Common SSL Errors in Chrome, Firefox & Safari — Causes & Fixes
These are the most frequent SSL errors seen in browsers and what each one means. Identify the root cause with this tool, then apply the targeted fix.
The certificate's valid_to date is in the past. The certificate has expired and must be renewed before browsers will trust the connection.
Renew the certificate through your CA or hosting provider. Verify auto-renewal is configured correctly — most CAs renew automatically within 30 days of expiry.
The domain in the browser's address bar is not listed in the certificate's CN or SAN fields. This happens after a domain migration, subdomain mismatch, or a certificate issued for the wrong domain.
Reissue the certificate including the correct domain. Check that both the apex domain (example.com) and the www subdomain (www.example.com) are in the SAN list.
The certificate was issued by a CA that is not in the browser's or OS's trust store. This includes self-signed certificates, internally-issued certificates, or certificates where the intermediate CA is missing from the chain.
Install a certificate from a publicly trusted CA. If using an internal CA, install the root certificate in the client's trust store. Ensure the server is sending the full intermediate chain.
The certificate has been explicitly revoked by the issuing CA — typically because the private key was compromised, the domain changed ownership, or the certificate was issued in error.
Obtain a new certificate immediately. If you did not revoke it, your private key may be compromised — rotate the key, reissue the certificate, and investigate the exposure.
The server is sending an HTTP response on an HTTPS port, or a proxy is returning an HTTP error before the TLS handshake completes. Port 443 is receiving plaintext instead of TLS.
Confirm the server is configured to serve TLS on the port being connected to. Check load balancer and proxy configurations — ensure SSL termination is set up correctly.
The client and server cannot agree on a TLS protocol version or cipher suite. Often triggered when the server still supports only TLS 1.0/1.1 (deprecated by Chrome 84+, Firefox 74+, Safari 14+), or uses cipher suites removed from modern browsers.
Enable TLS 1.2 and TLS 1.3 on the server and disable TLS 1.0 and TLS 1.1. Update your server's cipher suite list to remove RC4, 3DES, and export-grade ciphers. Use Mozilla's TLS configuration generator for ready-to-use Nginx and Apache configs.
How to Check an SSL Certificate (3 Steps)
Enter a Domain
Type any domain name — such as github.com or api.example.com — into the input field. The tool strips any https:// prefix automatically. You can also specify a custom port if the HTTPS service does not run on the default port 443.
Inspect the Certificate
In seconds you will see the full certificate: expiry date and countdown, issuer chain, trust status, protocol version (TLS 1.2 or 1.3), cipher suite, SANs, and SHA-256 fingerprint. No data is stored.
Read the Results
If the certificate is expired, self-signed, or has a hostname mismatch, the result flags the issue clearly. The expiry bar turns yellow within 30 days and red within 7 days. Copy all details with one click.
What Does an SSL Certificate Tell You?
An SSL/TLS certificate is a digital credential that authenticates a website's identity and enables an encrypted connection. When you visit a site over HTTPS, your browser verifies the site's certificate — issued by a trusted Certificate Authority (CA) — before establishing the encrypted channel. Without a valid certificate, browsers display security warnings and block access, directly impacting user trust and search rankings.
Every SSL certificate contains 3 key pieces of information:
- •Subject — the domain name (and organization for OV/EV) the certificate was issued to
- •Issuer — the Certificate Authority (CA) that signed and verified the certificate
- •Validity period — the exact start and end dates during which the certificate is trusted
What This Tool Does NOT Check
This tool performs a live TLS handshake and reads the certificate. It does not:
- Grade cipher suite strength (A–F) — use SSL Labs for a full TLS audit
- Check HSTS header or preload list status
- Test OCSP stapling configuration
- Detect certificate pinning (HPKP)
- Verify HTTP-to-HTTPS redirect behavior
SSL Certificate Types
Different certificate types offer different levels of identity verification. The type determines what the issuer checked before signing — not the encryption strength.
The CA verifies only that the applicant controls the domain — no company identity is checked. Issued in minutes via automated DNS or HTTP challenge. Suitable for blogs, personal sites, and internal tools. The subject will show only the CN (domain name), with no O (organization) field.
The CA verifies domain control plus the legal existence of the organization. Takes 1–3 business days. The certificate shows the company name in the O field — visitors can inspect the certificate and see who owns it. Recommended for business sites and APIs.
The most rigorous validation — the CA verifies domain, organization, physical address, legal status, and operational existence. Previously triggered the green address bar in browsers. Now shows the company name in certificate details. Required by financial institutions and e-commerce platforms handling payment data.
Covers a root domain and all first-level subdomains using a *.example.com pattern in the CN or SAN. A single wildcard certificate secures www.example.com, api.example.com, cdn.example.com, and more. Does not cover second-level subdomains like dev.api.example.com — those need a separate certificate.
A single certificate can cover multiple distinct domains via the Subject Alternative Names extension. Common for hosting multiple products under one certificate — e.g. example.com, example.io, and app.example.net. Most modern certificates use SANs even for single domains, with the CN mirrored in the SAN list.
When to Check an SSL Certificate
Before Deployment
Verify the certificate covers the exact domain being deployed. Confirm the issuer is a trusted CA (not self-signed), the SANs include the www and apex variants, and the protocol is TLS 1.2 or higher before pointing DNS to production.
Certificate Renewal Monitoring
Check expiry dates proactively. Let's Encrypt certificates expire every 90 days — a missed auto-renewal causes an outage. Commercial certificates typically last 1 year. Bookmark this tool and check monthly for anything under 30 days.
Security Audit
Identify servers still using TLS 1.0 or 1.1, weak cipher suites, or self-signed certificates. Cross-check the SHA-256 fingerprint against the expected value after a certificate rotation to confirm no MITM substitution occurred.
After Domain Migration
After moving a domain to a new host or CDN, verify the new certificate covers the domain, the issuer is correct, and the SANs match the expected set. A certificate left on the old server and not provisioned on the new one causes browser errors even when DNS is correct.
Frequently Asked Questions
Related Tools
Port Checker
Check whether port 443 is open and accepting connections before verifying the certificate.
DNS Lookup
Verify DNS A records point to the correct server after a certificate deployment or domain migration.
Port Info
Look up standard port assignments and understand which services run on which ports.