SSL Certificate Checker Inspect the active SSL/TLS certificate installed on a domain. Verify issuers, expiration dates, and SAN extensions.

Guide FAQ

Connects via port 443 to retrieve the public certificate chain. live TLS handshake · read-only · no signup

The SSL Certificate Checker connects to your domain over HTTPS, retrieves the full certificate chain, and analyzes validity, expiry, issuer trust, TLS version support, and cipher strength — returning a comprehensive security grade in seconds.

What is an SSL/TLS Certificate?

An SSL/TLS certificate is a digital certificate that authenticates the identity of a website and enables an encrypted connection between a web server and a browser. Despite the name, modern certificates use TLS (Transport Layer Security), not the deprecated SSL (Secure Sockets Layer) protocol.

When you visit a website over HTTPS, your browser verifies the site's certificate against trusted Certificate Authorities (CAs), checks that it has not expired, and ensures the domain name matches. A valid certificate signals to visitors — and to Google — that the site is legitimate and the connection is secure.

Encrypts data in transit between the browser and server (HTTPS)
Authenticates the website's identity through a trusted Certificate Authority
Required for Chrome, Firefox, and Safari to show the padlock icon
Google uses HTTPS as a ranking signal in search results
Without a valid SSL certificate, browsers show "Not Secure" warnings

Why SSL Certificate Health Matters

An expired, misconfigured, or untrusted SSL certificate causes browsers to display scary security warnings that stop visitors in their tracks. This directly impacts bounce rate, conversions, and SEO rankings.

Regular SSL auditing is essential because certificates expire, CAs can be distrusted, and cipher suites that were once secure can become vulnerable. Many breaches and man-in-the-middle attacks exploit misconfigured or expired certificates.

Expired certificates cause "Your connection is not private" errors in Chrome
Certificate chain issues (missing intermediates) break HTTPS for some users
Old TLS versions (TLS 1.0/1.1) are deprecated and blocked by modern browsers
Weak cipher suites expose traffic to downgrade attacks
Certificate revocation (via CRL/OCSP) can invalidate certificates before expiry

How to Use the SSL Checker

Enter the domain name (e.g., example.com) — no need to include https://
Click "Check SSL" to initiate the certificate handshake
Review the certificate subject, issuer, and validity dates
Check the certificate chain — all intermediate certificates must be present
Review TLS version support and cipher grade
Note the expiry date and set a renewal reminder

Understanding SSL Certificate Results

The checker returns several key fields about your certificate and connection:

Field / Value	Meaning
`Valid`	Certificate is signed by a trusted CA, not expired, and the domain name matches.
`Expiry Date`	When the certificate expires. Renew at least 30 days before expiry. Let's Encrypt certificates expire every 90 days.
`Days Remaining`	Days until the certificate expires. Below 30 days = warning. Below 7 days = critical.
`Issuer / CA`	The Certificate Authority that signed the certificate (Let's Encrypt, DigiCert, Sectigo, etc.).
`SANs`	Subject Alternative Names — the list of domains and subdomains the certificate is valid for.
`Chain Complete`	Whether all intermediate certificates are served correctly. Missing intermediates cause failures in some browsers.
`TLS Version`	The TLS protocol version negotiated. TLS 1.3 or 1.2 is required. TLS 1.0/1.1 are deprecated.
`HSTS`	HTTP Strict Transport Security header — tells browsers to always use HTTPS and never fall back to HTTP.

Common Problems & How to Fix Them

An expired certificate causes an immediate "Your connection is not private" error in all modern browsers. Visitors cannot proceed without dismissing a security warning.

Renew your certificate immediately through your CA or hosting provider. For automated renewal, use Let's Encrypt with Certbot (free, renews every 60 days).

When a server does not serve the full certificate chain (root CA + intermediate CA + leaf certificate), some browsers and HTTP clients fail to validate the certificate.

Fix: In your web server config, include the full chain file provided by your CA. For nginx, use ssl_certificate with the fullchain.pem file. For Apache, use SSLCertificateChainFile.

The domain in the certificate does not match the domain you are visiting. This happens when:
1. The certificate is for www.example.com but you access example.com (or vice versa) — fix: get a cert that covers both via SANs
2. The certificate belongs to a different domain entirely — wrong certificate configured in your web server

Request a new certificate that includes all domains and subdomains you serve.

TLS 1.0 and 1.1 are deprecated and disabled in Chrome, Firefox, and Safari. Servers still accepting these versions may be flagged as insecure.

In your server config:
- nginx: ssl_protocols TLSv1.2 TLSv1.3;
- Apache: SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1

Self-signed certificates are not trusted by browsers because they are not issued by a recognized Certificate Authority. Browsers show a red warning page.

Replace with a certificate from a trusted CA. Let's Encrypt provides free, automated certificates accepted by all major browsers.

Best Practices

Renew certificates at least 30 days before expiry — automate this with Let's Encrypt/Certbot
Always serve the complete certificate chain (root + intermediate + leaf)
Enable HSTS with a long max-age (minimum 6 months, ideally 2 years) and includeSubDomains
Support only TLS 1.2 and TLS 1.3 — disable all older protocol versions
Use strong cipher suites — prefer ECDHE for perfect forward secrecy
Include all subdomains you serve in the certificate's SANs
Enable OCSP stapling on your server to speed up certificate validation
Monitor certificate expiry with automated alerts (set at 60, 30, and 7 days)

Security Recommendations

Enable HSTS preloading at hstspreload.org for maximum protection against SSL stripping
Use CAA DNS records to restrict which CAs can issue certificates for your domain
Monitor Certificate Transparency logs for unauthorized certificates issued for your domain
Disable weak cipher suites (RC4, 3DES, export-grade ciphers) in server configuration
Enable HTTP/2 — it requires TLS and improves performance significantly

Frequently Asked Questions

This usually means: (1) Your website has mixed content — some resources (images, scripts, stylesheets) are still loading over HTTP instead of HTTPS. Open Chrome DevTools > Console to find mixed content warnings. (2) The page is served over HTTP and is not redirecting to HTTPS. (3) HSTS has not been configured, so the browser does not force HTTPS on repeat visits.

Renew at least 30 days before expiry. For Let's Encrypt certificates (90-day validity), Certbot automatically renews when less than 30 days remain. Set monitoring alerts at 60, 30, and 7 days. Never let a certificate expire on a production domain — browser warnings immediately destroy user trust.

Not exactly. SSL (Secure Sockets Layer) is the original protocol, now deprecated. TLS (Transport Layer Security) is the modern replacement. Versions SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 are all deprecated. Modern browsers require TLS 1.2 or TLS 1.3. The term "SSL certificate" is still commonly used, but all certificates issued today use TLS.

A wildcard certificate covers a domain and all its direct subdomains using a *.yourdomain.com SAN entry. For example, *.example.com covers mail.example.com, app.example.com, and www.example.com, but does NOT cover nested subdomains like app.api.example.com. Wildcard certificates are convenient but cannot be submitted to certificate transparency logs for individual subdomains.

When a browser receives your SSL certificate, it must verify a chain of trust back to a root CA that it already trusts. This chain typically goes: Root CA → Intermediate CA → Your Certificate. If any intermediate certificate is missing from your server's response, some browsers and HTTP clients will fail to validate the certificate, causing connection errors.

Let's Encrypt is the most popular free Certificate Authority. Use Certbot (free, open source) to automatically issue and renew Let's Encrypt certificates on your server. Most hosting control panels (cPanel, Plesk) and cloud providers (Cloudflare, AWS, Google Cloud) also offer free SSL/TLS certificate provisioning.

This means the certificate was issued by a CA that is not in the browser's trusted root store. This happens with: (1) Self-signed certificates you created yourself. (2) Certificates from internal/private CAs used inside corporate networks. (3) Certificates from CAs that have been distrusted by browser vendors (e.g., due to misissuance). The solution is to use a certificate from a publicly trusted CA like Let's Encrypt, DigiCert, or Sectigo.