SSL Certificate Checker
A free SSL certificate checker for any public domain. See who issued the certificate, when it was issued and when it expires, how many days are left, and every hostname it covers.
Certificate Checker
Enter a domain to inspect the certificate it serves.
Enter a domain to check its certificate.
What each field means
An SSL certificate proves a site is who it claims to be and lets the browser encrypt the connection. Certificates expire, usually every 90 days with Let’s Encrypt, and an expired one stops visitors at a full-page browser warning. Checking the expiry date and the names a certificate covers takes seconds and prevents the most avoidable outage there is.
Key benefits
Common use cases
How to use it
- 1. Enter a domain. Type the hostname you want to check, without https:// — for example example.com.
- 2. Run the check. The certificate served by that host is fetched and parsed.
- 3. Read the dates. Valid from and valid until frame the window; days remaining is what you act on.
- 4. Check the names. A certificate only secures the hostnames it lists, so confirm yours is covered.
Key features
- See the issuer and the full validity window
- Know exactly how many days are left
- Check every hostname the certificate covers
- Catch a renewal that silently failed
- Before and after a certificate renewal
- After moving a site to a new host or CDN
Common certificate problems and how to fix them
Most certificate warnings come from a handful of causes. Match what the checker reports to the cases below to find the fix quickly. After any fix, run the check again from this page to confirm the browser warning is gone.
The name does not match
The certificate does not list the hostname that was visited, often the www or the bare domain. Reissue the certificate with both names, or redirect the missing name to one that is covered.
Expired or about to expire
Automatic renewal usually fails because a DNS or HTTP validation request could not reach the server. Fix the validation path, renew, then confirm the new expiry date here.
The chain is incomplete
The server sends its own certificate but not the intermediate one. Desktop browsers may cope, while phones and API clients fail. Install the full chain file from your certificate authority.
It works on one server but not another
Behind a load balancer or CDN, each node can serve a different certificate. Check every hostname after a renewal, because one forgotten server is enough to break some visitors.
Frequently asked questions
How often do SSL certificates expire?⌄
It depends on the issuer. Let’s Encrypt issues 90-day certificates and expects automated renewal; commercial certificate authorities typically issue for one year. Either way the renewal should be automated and monitored, because a silent renewal failure looks fine until the day it does not.
What happens when a certificate expires?⌄
Browsers stop the visitor with a full-page interstitial warning rather than loading the site. Almost nobody clicks through it, so an expired certificate is effectively an outage, and API clients will refuse the connection outright.
Why does the certificate not cover my subdomain?⌄
A certificate only secures the exact hostnames listed on it. A certificate for example.com does not automatically cover www.example.com or api.example.com unless those names are listed or it is a wildcard for *.example.com.
How many days ahead should I renew?⌄
Start renewing with at least 30 days to spare. That leaves room for a failed automated attempt, a DNS validation problem or a holiday weekend, and still gets you a new certificate before anything breaks.
Does this tool see my private key?⌄
No, and it could not. Only the certificate is public, and that is all this checks. The private key never leaves your server and is never part of what a client receives.