SSL certificate checker
Open a live TLS connection to any host and read back the certificate exactly as a browser would see it: issuer, expiry date, covered hostnames, chain and negotiated protocol.
What to look for
Days until expiry
An expired certificate does not degrade gracefully — every visitor gets a full-page browser warning and most turn back. If you renew manually, treat anything under 21 days as urgent. If you use an automated issuer such as Let's Encrypt, certificates are typically 90 days long and renew at 30 days remaining; seeing fewer than 25 days left means renewal has quietly stopped working.
Hostname match
The certificate must list the exact hostname visitors type. A certificate for example.com does not cover www.example.com unless that name is listed too, and a wildcard such as *.example.com covers one level of subdomain — not the bare domain, and not a.b.example.com.
The chain
Servers must send the intermediate certificates that connect their certificate to a trusted root. A missing intermediate is the classic bug that "works in Chrome on my laptop" — because the browser cached the intermediate from another site — but fails on mobile devices and API clients.
Protocol and cipher
TLS 1.3 is current and fastest; TLS 1.2 remains fine. If a host still negotiates TLS 1.0 or 1.1 it is failing PCI DSS and modern browser requirements.
FAQ
What does "self-signed certificate" mean here?
The certificate was issued by the same entity that it identifies, so no public authority vouches for it. Browsers will warn. It is normal on internal servers and behind a proxy such as Cloudflare, but wrong on a public site.
My certificate is valid but browsers still complain
Usually mixed content — the page loads images or scripts over plain HTTP — or a missing intermediate in the chain. Both show up here: check the chain section and then run the HTTP header check.
Does an SSL certificate make my site secure?
It encrypts the connection and proves you control the hostname. It says nothing about the security of the application behind it. The header check is a better guide to that.
Related reading
Other tools
Website status checker
Is it up, how fast, and what is it running?
Ping test
Round-trip latency and packet loss.
DNS lookup
A, AAAA, MX, NS, TXT, SOA and CAA records.
HTTP header & security check
Every response header, graded for security.
Open port checker
Which TCP ports answer from the outside.
WHOIS lookup
Registrar, age, expiry and nameservers.
Want this checked automatically?
Free monitoring every 5 minutes with email alerts when something breaks.