SSL Checker
Check a website's SSL/TLS certificate: who issued it, when it expires, and whether browsers will trust it.
Loading SSL Checker… If nothing happens, please enable JavaScript.
Every HTTPS website presents a certificate during the TLS handshake. That certificate binds the site's hostname to a public key and is signed by a certificate authority (CA) that browsers already trust. When something is off, the certificate expired last night, the server forgot to send its intermediate certificate, or the name on the certificate does not match the domain, visitors get a full-page security warning and most of them leave. This SSL checker connects to the server the same way a browser does and tells you exactly what it presents.
Examples
example.com
Trusted chain · Name matches · 54 days left · EC 256 bit · TLSv1.3
A healthy certificate: every check passes.
a site serving only its leaf certificate
Not trusted: the intermediate certificate(s) are missing
Often works in desktop browsers but fails on phones, curl and API clients.
Frequently asked questions
Why does my site work in my browser but the checker says the chain is not trusted?
What does 'name mismatch' mean?
How many days before expiry should I renew?
Can I check a mail server or another port?
What key size and signature algorithm are acceptable today?
Does the checker test for vulnerabilities like Heartbleed or weak ciphers?
What are the SHA-256 and SHA-1 fingerprints for?
Are the domains I check logged?
About SSL Checker
Enter a domain (or paste a full URL) and the tool performs a real TLS handshake with SNI set to that hostname. It reports the certificate subject and issuer, the validity window and the number of days left, the public key type and size, the signature algorithm, the serial number, SHA-256 and SHA-1 fingerprints, every Subject Alternative Name the certificate covers, and the full chain of intermediate certificates the server sends. It also shows the negotiated TLS version and cipher suite.
The verdict is built from independent checks. Trust is tested with a second handshake that verifies the chain against a standard root store, so a self-signed certificate, a private CA or a missing intermediate is caught even when your own browser has the intermediate cached and looks fine. The hostname is matched against the SAN list using the same wildcard rules browsers apply (a wildcard covers exactly one label, so *.example.com does not cover example.com or a.b.example.com). Expiry, not-yet-valid dates, short RSA keys, SHA-1 signatures and old TLS versions are flagged too.
The check runs from our server, so it shows what the public internet sees, which is what matters after a certificate renewal or a CDN change. Private and internal addresses are blocked, and only TLS ports are allowed (443, 8443, and the implicit-TLS mail and LDAP ports 465, 993, 995 and 636). Nothing about the hosts you check is stored.
From Netscape's SSL 2.0 to 47-day certificates
SSL was created at Netscape in 1994 to make online shopping possible. Version 1.0 was never released because of serious flaws, and SSL 2.0, shipped in Netscape Navigator in 1995, was broken soon after. SSL 3.0 (1996) was a redesign, and its successor was renamed TLS 1.0 in 1999 when the IETF took over the protocol, partly to avoid looking like it simply endorsed Netscape's work. People still say 'SSL certificate' even though SSL itself has been forbidden for years.
Certificate lifetimes have shrunk steadily. In the early 2010s you could buy a certificate valid for five years. The CA/Browser Forum cut the maximum to 39 months in 2015, 825 days in 2018, and Apple unilaterally enforced 398 days in 2020 by making Safari reject anything longer. In 2025 the Forum voted to go further, stepping the maximum down to 47 days by 2029, which makes automated renewal effectively mandatory.
Let's Encrypt changed the economics of HTTPS when it launched in 2015 with free, automated certificates and 90-day lifetimes chosen on purpose to push automation. Within a few years it became the largest certificate authority in the world, issuing millions of certificates a day, and the share of web page loads over HTTPS in Chrome went from under half to well over 90 percent.