SSL Certificate Checker

Type a website and our server opens a secure connection to it, reads the certificate and checks it the way a browser does. You get a plain verdict, trusted or what is wrong (expired, wrong name, missing intermediate, self-signed or an untrusted authority), the days left before it expires, the issuer, every name it covers, the key, the protocol and cipher, and the chain the server sends. Mail and other services can be checked on their own ports.

How it works

SSL Certificate Checker is a web page. Our server connects to the site you name to read its certificate; nothing is stored. There is no account and no sign-up; to keep it quick for everyone, each connection has an hourly limit, well above normal use.

Straight to one job

SSL Expiry Checker

What the checker looks at

When a browser opens an https page, the server presents a certificate. The browser trusts it only if four things hold: it was issued, directly or through intermediate certificates, by an authority the browser trusts; it covers the exact name in the address bar; it is within its validity dates; and it has not been revoked. The checker opens the same kind of connection from our server, verifies the chain against the standard list of trusted authorities, and tells you which of these fails, if any.

The common problems

Certificate lifetimes are getting shorter

Public certificates used to last a year or more. The CA/Browser Forum, which sets the rules browsers enforce, has voted to cut the maximum step by step from 398 days to 47 days by 2029, and many sites already use 90-day certificates that renew automatically. Checking the days left now and then catches a renewal job that has quietly stopped working before visitors see a warning.

Other ports

Mail servers, control panels and other services use certificates too. Pick the port in the list to check, for example, the certificate on a mail server's port 993 or 465. Only the usual secure ports can be checked, and nothing is sent to the server beyond the secure handshake.

What it does

• Trusted or not, with the reason in plain words
• Days left before expiry, flagged under 30
• Every name the certificate covers
• Missing intermediate certificates caught
• Issuer, validation type, key and signature
• Protocol and cipher of the connection
• The full chain the server sends
• Mail and other ports: 465, 993, 995, 8443 and more

Questions

How do I check if an SSL certificate is valid?

Type the website and press Check. The verdict at the top says whether browsers trust the certificate, and if not, why.

How do I check when an SSL certificate expires?

The days left and the expiry date appear at the top of the result. Under 30 days is flagged so you can renew in time.

What does a missing intermediate certificate mean?

The server sends only its own certificate without the intermediate one that links it to a trusted authority. Some browsers fill the gap themselves, but many apps and devices refuse. Install the full chain file your certificate provider gives you.

Why does my certificate not cover www?

A certificate lists the exact names it is valid for. If it was issued for example.com only, www.example.com shows a warning. Reissue it with both names.

Can I check a mail server's certificate?

Yes. Choose port 993 for IMAP, 995 for POP3 or 465 for SMTP, and type the mail server's name.

Is the site I check stored?

No. Our server connects, reads the certificate and sends you the result. We only count how many checks are made.

More

Privacy policy · Support · Changelog