SSL Checker – check an SSL certificate online

It establishes a real TLS connection to the host you enter and reads the certificate served by the server. You’ll see the overall status, issuer, “Valid from” and “Valid until”, time remaining and validity period in days, all names in the certificate (Subject Alternative Names), TLS protocol and cipher, key type, key usage, serial number, SHA-256 fingerprint and certificate chain.

Enter the domain and start the check. Under “Validity”, you’ll find “Valid from” and “Valid until” in UTC. The status shows how many days remain until the certificate expires or how many days ago it expired. If fewer than 14 days remain, the status is “Expiring soon”.

Browsers show a security warning when you visit the site. The checker reports the status “Expired” and shows how many days ago the certificate expired. Renew the certificate on your server, then check again.

Yes. Enter the host and port separated by a colon, such as example.com:8443. Without a port, the checker uses the default HTTPS port 443. Put IPv6 addresses in square brackets. The checker supports services that use TLS directly on the port. It does not negotiate STARTTLS, which mail servers use on ports such as 25 or 587.

“Untrusted” means the certificate chain could not be verified back to one of the standard certificate authorities trusted by browsers, for example because an intermediate certificate is missing or the issuer is unknown. The checker also shows the technical reason, such as DEPTH_ZERO_SELF_SIGNED_CERT. Self-signed means the certificate was issued by itself, with no public certificate authority behind it. The checker flags this separately. Browsers show a security warning in both cases.

The certificate was issued for a different domain or subdomain than the one you checked. Browsers will block access to the site even if the certificate is otherwise valid. Compare the name you checked with the list of Subject Alternative Names in the result—for example, check whether both example.com and www.example.com are included.

That depends on the issuer. The checker shows the certificate’s validity period in days. Let's Encrypt certificates are valid for 90 days and are usually renewed automatically. Check manually managed certificates regularly so you don’t miss a renewal.

The checker caches a successful result for up to 30 minutes per host and port. Check again a little later after renewing a certificate. Failed connections are not cached.

No. The checker connects from our server over the public internet. It rejects hosts with private or local IP addresses, and servers behind a firewall without an open port cannot be reached.

Yes, it’s free and you don’t need an account. There’s a short wait after each check, and you can run up to 15 checks per minute per IP address. After a check, the host you checked appears as ?target= in the address bar. You can share this link to run the same check again.