SSL Certificate Checker
Inspect a site's TLS certificate before its expiry inspects you.
Free, no signup — the answer appears right here.Try:
What this checker shows
A live TLS handshake against the domain, decoded: who issued the certificate, exactly when it expires (with the days-remaining countdown that should be on a calendar), every hostname it covers (SANs), the negotiated protocol version and cipher, and whether the certificate actually validates — or is self-signed, expired, or served for the wrong name.
Certificate lifetimes keep shrinking — 90-day certificates are the norm with Let's Encrypt and the CA/Browser Forum is pushing maximums down industry-wide — so silent renewal failure is now the dominant cause of sudden site outages.
Failures this catches early
Expired or expiring-this-week certificates; name mismatches (certificate for www but not the apex, or vice versa); incomplete chains that work in Chrome but fail on older clients and many APIs; deprecated protocols (TLS 1.0/1.1) still enabled; and self-signed certificates where a real one was intended.
The same report grades the domain's broader security posture — HSTS and security headers, DNSSEC, email authentication — because a perfect certificate on an unhardened site is a start, not a finish.
Methodology & data sources
The check performs a real TLS handshake to port 443 with SNI at the moment you submit — no cached scans — and decodes what the server actually presented: issuer, validity window with days remaining, subject alternative names, negotiated protocol and cipher, and whether the chain validates or the certificate is self-signed.
Because it's a live handshake, the result is exactly what a browser connecting right now negotiates. Try expired.badssl.com to see what a failing certificate looks like.
Frequently asked questions
How do I check when my SSL certificate expires?
Run the check — the report shows the exact expiry timestamp and days remaining. If renewal is automated (Let's Encrypt, your host's managed TLS), verify the days-remaining keeps resetting to ~90; a countdown past 30 days on an 'automated' setup means the automation is broken.
What is a SAN and why does my certificate need the right ones?
Subject Alternative Names are the hostnames a certificate is valid for. Browsers match the visited hostname against the SAN list only (Common Name is ignored). If example.com is listed but www.example.com isn't, the www site throws a certificate error.
What does an incomplete chain mean?
Your server must send its certificate plus the intermediate certificates linking it to a trusted root. Some clients fetch missing intermediates themselves (so it 'works in Chrome'), but many API clients, older devices and strict libraries don't — they just fail. Always serve the full chain.
Is TLS 1.2 still okay?
Yes — TLS 1.2 with modern ciphers remains acceptable; TLS 1.3 is preferred. What gets flagged is TLS 1.0/1.1 (deprecated since 2020) or SSLv3 still being accepted.