SSL Certificate Checker — verify validity and expiry
Instantly verify any HTTPS URL's SSL certificate — check whether it's valid and trusted, how many days until it expires, who issued it, which domains it covers (Subject Alternative Names), and which TLS version and cipher suite the server negotiates. The check performs a real TLS handshake server-side, so results match what a browser actually sees. Free, no signup required.
What does an SSL certificate checker verify?
An SSL/TLS certificate is a cryptographic file installed on your web server that proves the server's identity and enables encrypted HTTPS connections. When a user visits your site, their browser performs a TLS handshake: it downloads your certificate, checks that it was signed by a trusted Certificate Authority (CA), and verifies the certificate hasn't expired and covers the domain being visited.
Common SSL problems include: expired certificates (browsers show a red "not secure" warning), certificates issued to the wrong domain (common after site migrations), weak TLS versions still being negotiated (TLS 1.0/1.1 are deprecated), and missing SANs (Subject Alternative Names) for www vs. apex domain mismatches. This tool checks all of these in a single server-side TLS handshake.
Frequently asked questions
- An "untrusted" SSL certificate means the certificate was not signed by a Certificate Authority (CA) that the browser recognises — it might be self-signed, signed by an internal CA, or the certificate chain is incomplete (missing an intermediate certificate). All major browsers and operating systems maintain a list of trusted root CAs. Certificates from Let's Encrypt, DigiCert, Sectigo, and other commercial CAs are automatically trusted.
- Renew your SSL certificate at least 30 days before expiry to allow time for verification and deployment. Many automated systems (Let's Encrypt via Certbot, AWS Certificate Manager) renew 30–60 days before expiry. Expired certificates cause browser warnings that immediately stop users from accessing your site — even a one-day gap in coverage costs traffic and trust.
- TLS 1.3 (released 2018) is faster and more secure than TLS 1.2. It reduces the handshake from 2 round trips to 1 (faster connection setup), removes deprecated cipher suites, and supports 0-RTT resumption for returning users. TLS 1.0 and 1.1 are deprecated (RFC 8996, 2021) and are disabled in all major browsers. If your server still negotiates TLS 1.0/1.1, upgrade your server configuration.
- Subject Alternative Names (SANs) are the list of domain names and IP addresses a certificate is valid for. Modern SSL certificates use SANs instead of the older CN (Common Name) field, which only supports a single domain. A wildcard SAN like *.example.com covers all subdomains (www.example.com, api.example.com) but not example.com itself — you need both entries. Multi-domain (SAN) certificates can cover up to 250 domains in a single certificate.
Related tools
- → Security Headers Checker — check CSP, HSTS, X-Frame-Options, and more
- → DNS Lookup Tool — query A, MX, TXT, NS, and all DNS record types
- → Redirect Tracer — trace the full redirect chain for any URL
Related reading: How to Check an SSL Certificate — Expiry, Chain & Issues