SSL Certificate Checker

Check the SSL/TLS certificate of any website instantly — expiry date, issuer, domain coverage and full trust status. Free, no sign-up needed.

Port
Port defaults to 443. Change for mail (465, 993) or any custom HTTPS port.
Enter a domain to check its SSL certificate
Type any domain name or IP address above and click Check SSL to see the full certificate details, expiry status, trust level and domain coverage.
Not stored or logged
Real-time check
No sign-up needed
Unlimited free checks

What This Tool Checks

This checker connects directly to your target server and retrieves the live SSL/TLS certificate in real time using a full TLS client handshake. It runs four security checks simultaneously and displays the raw certificate data including Common Name, issuer chain, validity window, Subject Alternative Names, signature algorithm and serial number.

Browser Trust Status

Verifies the certificate chain against the system's public CA trust store, the same way a real browser does.

Expiry & Days Remaining

Shows the exact valid-from and valid-until dates with a live countdown of days remaining until expiry.

Domain Coverage (SANs)

Lists every hostname covered by the certificate's Subject Alternative Name extension, highlighting matches and wildcards.

Certificate Details

Full issuer chain, Common Name, organisation, signature algorithm and serial number for complete auditability.

How SSL Certificate Trust Works

Browsers do not trust every certificate directly. They maintain a list of root Certificate Authority (CA) certificates built into the operating system or browser itself. Your server certificate is signed by an intermediate CA, which is in turn signed by a root CA in that trust store. This is the certificate chain. For a browser to show the padlock without a warning, your server must present the complete chain — your certificate plus all intermediate certificates — during the TLS handshake.

Missing intermediates are one of the most frequent causes of "not trusted" errors that appear fine in one browser but fail on older devices and phones. Older devices have fewer intermediates pre-cached and cannot build the chain themselves. After installing or updating a certificate, always verify the full trust result here. For a complete picture of domain security, also confirm DNS is resolving correctly with our DNS Lookup tool.

Diagnosing Common SSL Problems

Frequently Asked Questions

What is the difference between SSL and TLS?

SSL (Secure Sockets Layer) was the original encryption protocol developed in the 1990s. TLS (Transport Layer Security) replaced it with a redesigned handshake and stronger cipher suites. Modern browsers enforce TLS 1.2 as the minimum; TLS 1.3 is now the standard for new connections. SSL 2.0 and 3.0 are completely deprecated and blocked by all current browsers. The term "SSL certificate" has persisted in common usage even though the underlying protocol is TLS — the certificate format itself (X.509) has not changed.

When this tool reports a certificate as trusted and valid, it means a successful TLS handshake was completed using the certificate presented by the server. The "SSL" label in the tool name follows the same widely understood convention rather than technically correct "TLS" terminology.

What are Subject Alternative Names and why do they matter?

Subject Alternative Names (SANs) define which hostnames an SSL certificate actually covers. Browsers stopped honouring the Common Name field for domain matching years ago — SANs are now the sole authoritative source for determining whether a certificate covers a given hostname. A single certificate can cover dozens of domains and subdomains simultaneously, which is why a single certificate is often shared across an entire platform.

Wildcard entries like *.example.com cover all immediate subdomains — www.example.com, api.example.com — but not deeper levels like v2.api.example.com. The SAN panel in the results above highlights your queried hostname in green if directly matched, and in blue if covered by a wildcard. If neither applies, the domain mismatch check fails and browsers will show a certificate error for that hostname.

How far in advance should I renew my SSL certificate?

Renew at least 30 days before expiry — this checker flags certificates with 30 or fewer days remaining with an amber warning. Let's Encrypt auto-renews at 60 days remaining to build in buffer for failed first attempts, which is why if you see fewer than 60 days on a Let's Encrypt certificate, it is worth investigating whether your auto-renewal is still working correctly.

For paid commercial certificates (OV and EV tiers), start the renewal process 60–90 days out to allow time for domain validation, organisational verification, deployment and testing across all servers. After renewal, run this check again to confirm the new certificate is live and trusted, and that its SANs correctly cover all the hostnames you need. Also verify HSTS is still active after any certificate or server configuration change.

What does "not trusted" mean and how do I fix it?

Not trusted means the certificate was issued by a Certificate Authority not present in the browser's or operating system's built-in trust store. This is typical of self-signed certificates, certificates from private internal CAs, or a broken chain where intermediate certificates are missing from the server's configuration. Browsers display a full security warning and block access by default — users cannot bypass this without manually accepting an exception, which is not acceptable for public-facing services.

To fix it: replace with a certificate from a publicly-trusted CA — Let's Encrypt is free, fully automated, and trusted by all major browsers and operating systems. For internal-only services where users are on managed devices, deploy your root CA certificate to all client devices via group policy or MDM. Also verify your server is sending the complete certificate chain including all intermediate certificates, not just the end-entity certificate.

Can I check SSL certificates on non-standard ports?

Yes — change the port number in the port field next to the search bar before clicking Check SSL. The default is 443 for HTTPS. Common non-standard TLS ports include 465 (SMTPS — encrypted SMTP), 993 (IMAPS — encrypted IMAP), 636 (LDAPS — encrypted LDAP) and 990 (FTPS — encrypted FTP). Custom application servers often expose HTTPS APIs on ports such as 8443 or 4443.

Before checking SSL on a custom port, confirm it is actually open using our Port Checker — a closed or firewalled port returns a connection error rather than a certificate result, which can be misread as a missing certificate when the certificate is actually fine and the connectivity is the real issue.

What does the signature algorithm field mean?

The signature algorithm shows how the Certificate Authority cryptographically signed your certificate. Modern certificates use sha256WithRSAEncryption or an ECDSA variant such as ecdsa-with-SHA256. These are current industry standards and indicate a secure certificate.

Older certificates using SHA-1 (sha1WithRSAEncryption) were deprecated by browsers in 2016 and will trigger security warnings in all modern browsers — reissue immediately if you see SHA-1 in the results. ECDSA algorithms produce smaller certificates and faster TLS handshakes than RSA at equivalent security levels, which is why Let's Encrypt and modern CAs default to them for new certificates. The performance improvement is particularly noticeable on mobile devices.

What is HSTS and how does it relate to my certificate?

HTTP Strict Transport Security (HSTS) is a response header that instructs browsers to always connect to your site over HTTPS, even if the user types http:// or clicks an unencrypted link. A valid, trusted SSL certificate is a prerequisite — HSTS has no protective effect on an expired or untrusted certificate because browsers will not honour it from an insecure connection, and a browser that has previously cached an HSTS policy will refuse to connect at all if the certificate is invalid.

SSL and HSTS work as complementary security layers: the certificate enables encryption and server authentication; HSTS prevents browsers from ever downgrading to plain HTTP even if an attacker attempts to intercept and redirect traffic. After confirming your certificate is valid here, check your HSTS header is present, correctly configured, and has an appropriate max-age value using our HTTP Headers tool.

Is this checker storing my query data?

No. Every result is fetched live from the target server at the moment you submit the form — there is no caching, no query logging and no data retention beyond the duration of the server-side TLS connection. No account is required, so there is no user profile for queries to be associated with.

Standard web server access logs record the URL of each page request — which includes the domain you checked as a query parameter — for security and uptime monitoring purposes. These logs are periodically rotated and are not used for user tracking, behavioural profiling or advertising. For a complete domain health workflow, combine this with our DNS Lookup, WHOIS Lookup and Port Checker — all free and real-time with no sign-up.