SSL Certificate Checker
Check a site's TLS certificate: issuer, expiry and days left, SANs, chain, protocol and whether the host name matches.
Check a TLS certificate
We open a real TLS connection from our server and read the certificate the host presents.
What the SSL Certificate Checker does
SSL Certificate Checker opens a real TLS connection to the host and port you give it, exactly as a browser would, and shows what the server sent back: the certificate's common name and every subject alternative name, the issuer, the validity window with the number of days left, the serial number, the signature algorithm, how many certificates were in the chain and which TLS version and cipher were negotiated.
Verification is done first with full checks on. If that fails the tool reconnects without verification so it can still read the certificate and tell you why it failed: expired, not valid yet, self-signed, a host name that does not match, or a missing intermediate. Each problem is listed as a warning with a plain explanation rather than a bare OpenSSL error code.
Run it after installing or renewing a certificate, when a client reports a browser warning you cannot reproduce, or on a mail or API server where the port is not 443. Only public hosts can be checked.
Step by step
- 01Enter the host name. Leave the port at 443 for a website, or set 993, 465, 8443 or another port for mail and API servers.
- 02Press Check. The handshake usually takes under two seconds.
- 03Look at the status pill and the warnings first; a green result means browsers will accept the certificate for this host.
- 04Check the days remaining and the issuer, then the SAN list to confirm that www and the bare domain are both covered.
Common questions
Browsers cache intermediate certificates from other sites and quietly fill in the gap; a fresh client cannot. The server should send the intermediate along with its own certificate (the "fullchain" file). Until it does, some phones, mail clients and API consumers will fail.
Subject alternative names are the list of host names the certificate is valid for. Modern browsers ignore the common name and only read SANs, so a certificate for example.com must also list www.example.com or that variant will show an error. A wildcard such as *.example.com covers one level of subdomains but not the bare domain.
Let's Encrypt certificates last 90 days and are meant to renew automatically at 30 days left; a certificate under 30 days from a free CA usually means the renewal job is broken. Paid certificates run a year; renew in the last month. From 2026 the maximum lifetime is dropping further, so automation is the only sustainable answer.
Yes. Any port that speaks TLS directly works: 465 and 993 for mail, 8443 for admin panels, 5061 for SIP. Ports that start plain and upgrade with STARTTLS (25, 587, 143) will fail here because the tool does not speak those protocols.
Keep checking
Domain to IP
Find the IPv4 and IPv6 addresses behind a domain, the reverse DNS name of each and a hint at the hosting provider.
Free toolDNS Lookup
Look up the A, AAAA, CNAME, MX, NS, TXT, SOA, SRV and CAA records of any domain with their TTLs in one query.
Free toolWebsite Down Checker
Check from our server whether a website is up: status code, response time, redirects, server header and DNS.
Free toolRedirect Checker
Trace a URL's redirect chain hop by hop, spot loops, meta refresh and JS redirects, and compare the http, https and www variants.
Free toolWHOIS Lookup
Registrar, creation and expiry dates, name servers, status and DNSSEC for a domain, or the network owner of an IP.
Want these fixes done for you?
Our team runs the audit, makes the changes and reports the result.