SSL Certificate Checker

What the SSL checker looks at

Enter a host name and our server opens a TLS connection to it, downloads the certificate and runs it through the same tests a browser does before showing the padlock:

1. The certificate must be issued for this exact name. Both the Common Name and the Subject Alternative Names count, and a wildcard like *.example.com covers shop.example.com but not example.com itself or a.b.example.com.
2. Today's date must be inside its validity period, so it's neither expired nor issued for the future.
3. It must be signed by a certificate authority that browsers trust. A self-signed certificate fails here, which is exactly what visitors would see as a full-page warning.

If everything passes, you get the issuer, the expiration date and the number of days left, plus the full list of names the certificate covers. That list is handy when you're unsure whether www was included when the certificate was ordered.

Common errors and what they usually mean

Certificate hostname mismatch. The server presented a certificate for some other name. Typical causes: a new subdomain was pointed at a server before anyone added it to the certificate, or the hosting provider is serving its default certificate because the site isn't configured for HTTPS at all.

Certificate expired. Auto-renewal stopped working at some point and nobody noticed. With Let's Encrypt this is often a cron job that died, a DNS change that broke validation, or a renewed certificate sitting on disk while the web server was never reloaded to pick it up.

Chain validation failed. The certificate isn't signed by anyone browsers recognize. It may be self-signed, issued by an internal company CA, or (rarely) issued by an authority that has since been distrusted.

Could not establish connection. Nothing answered with TLS on that port. Check that the port is open and that the service speaks TLS right away.

Checking ports other than 443

HTTPS is the default, but any service that starts with TLS from the first byte works: 465 for SMTPS, 993 for IMAPS, 8443 for an admin panel, and so on. Ports that upgrade to TLS later with STARTTLS, such as SMTP on 587, won't work with this check, because the connection begins as plain text.

Don't let it expire again

Certificate lifetimes keep getting shorter. Let's Encrypt certificates last 90 days, and the CA/Browser Forum has voted to bring the maximum for all public certificates down to 47 days by 2029. More renewals mean more chances for one of them to fail quietly. An SSL monitor checks the certificate every minute, warns you 30, 10 and 1 day before expiration, and alerts you right away if the certificate becomes invalid for any other reason.