SSL Certificate Checker

Type a domain name and the tool opens a normal HTTPS connection to it from our server, reads the certificate the site presents, and reports what it found. The days remaining figure is the one to look at first; below it you get the issuer, the name the certificate was issued to, the validity window and the TLS version the two sides agreed on. You can paste a full URL — anything after the host name is ignored.

A certificate on its own proves nothing. What makes it trusted is a chain: your browser ships with a store of root certificates from a few dozen certificate authorities, each root signs intermediate certificates, and an intermediate signs the certificate a website presents. When you connect, the server sends its own certificate plus the intermediates, and the browser walks the chain upward until it reaches a root it already trusts. The issuer shown here is the organisation that signed the site certificate — usually an intermediate CA such as one operated by Let's Encrypt, Google Trust Services or DigiCert. If a server forgets to send its intermediate, desktop browsers often paper over the gap while phones and command-line clients fail outright, which is why a site can look fine to you and broken to a colleague.

Expiry is the failure everyone eventually meets. Certificates are deliberately short-lived — ninety days for Let's Encrypt, and the industry is moving shorter still — because a stolen key stops being useful once the certificate lapses. The trade-off is that renewal has to be automated and the automation has to be watched. When a certificate does expire, browsers do not show a small warning: they interrupt with a full-page block that most visitors will not click through, and API clients simply refuse the connection. Renewal typically runs thirty days ahead, so anything under two weeks means the automation has already failed twice and needs a human. That is exactly where this tool turns the number amber.

The name list matters as much as the date. A certificate is valid only for the names inside its subject alternative name extension, and browsers ignore the old common name field entirely. A wildcard such as *.example.com covers one level — blog.example.com yes, shop.eu.example.com no — and it does not cover the bare example.com unless that name is listed separately, a mismatch that catches people every week. The TLS version line tells you what the connection actually negotiated: TLS 1.3 is current and the handshake is faster, TLS 1.2 is still fine, anything older is long deprecated and will be refused by up-to-date clients.

Only the domain name you type is sent to our server, which then connects to that public host. No file is uploaded, and nothing about your own connection is examined or stored.