SSL Certificate Checker

Enter a domain to inspect the certificate it actually serves. You get the expiry date and days remaining, who issued it, every hostname it covers, whether the intermediate chain is complete, and which TLS version was negotiated.

An expired certificate shows every visitor a full-page browser warning, and an incomplete chain breaks quietly — often working in desktop browsers while failing on mobile devices, API clients and payment callbacks. This checks both.

How it works

The tool opens a genuine TLS connection to the host on port 443, exactly as a browser would, and reads the certificate the server presents. Nothing is taken from a cache or a third-party database, so what you see is what your visitors get right now.

Four things are worth understanding in the result:

• Days remaining — most certificates last 90 days (Let's Encrypt) or a year. If automatic renewal is working you should never see this drop below about 30.
• Covered hostnames — the Subject Alternative Name list. A certificate for example.com does not automatically cover www.example.com; both must be listed. A wildcard such as *.example.com covers one level of subdomain only, so it matches shop.example.com but not a.b.example.com.
• Chain — servers must send the intermediate certificate(s) linking their certificate to a trusted root. Browsers often paper over a missing intermediate by fetching it themselves; many other clients do not, which is why "it works in Chrome but our app can't connect" is such a common report.
• Self-signed — a certificate that vouches for itself. Fine for internal testing, but every public visitor sees a security warning.

Frequently asked questions