Domain & website
SSL certificate checker
Check a domain SSL/TLS certificate: days remaining, who issued it, whether it matches the hostname, and whether the chain is complete.
What is SSL certificate checker?
Every site served over HTTPS carries an SSL/TLS certificate. It does two jobs: it encrypts the connection, and it proves the server you are talking to really controls that domain. If the certificate expires, was issued for a different name, or is missing an intermediate, the browser blocks visitors with a full red warning page, and most of them leave immediately.
This tool opens a real TLS connection to the host you enter, reads the exact certificate that server presents, and lays it out: expiry date, issuer, key type, protocol version, and the full chain from your domain up to the trust root. It also checks something many tools skip, namely whether the hostname you asked about is genuinely covered by the certificate.
The reason this runs on a server rather than in your browser is simple: JavaScript is not allowed to open a raw TLS socket, and there is no browser API for reading another site certificate. That is a constraint of the browser itself, not a design choice here.
The most common failure is not expiry, it is a missing intermediate certificate. Your own machine may still load the site because it cached that intermediate from somewhere else, while your visitor phone does not. Check the chain section: a healthy setup usually shows three levels, and a single level means something is missing.
How to use
- Enter a domain such as example.com. Pasting a full URL is fine, the hostname is extracted for you.
- Pick a different port if your service does not run on 443, for example 8443 for an admin panel or 993 for IMAP.
- Read the verdict line at the top first: green means valid, red means there is a problem and the error code sits right beside it.
- If the days remaining turn amber, that is your cue to check whether automatic renewal is still working.
- Open the chain section to confirm the intermediate certificates are being served.
Frequently asked questions
The certificate has not expired, so why is it flagged?
Expiry is only one of several conditions. The error code beside the verdict says which one failed: DEPTH_ZERO_SELF_SIGNED_CERT means a self-signed certificate, UNABLE_TO_VERIFY_LEAF_SIGNATURE usually means a missing intermediate, and ERR_TLS_CERT_ALTNAME_INVALID means it was issued for a different hostname.
How early should I renew?
Let's Encrypt renews automatically at 30 days remaining. So anything under 30 days is worth a look, and under 14 days almost certainly means renewal has broken. For a paid one-year certificate, renew at least two weeks ahead.
Why does my certificate list hostnames I do not recognise?
One certificate can cover several names through the SAN field. If you sit behind Cloudflare or a similar service, the certificate may be theirs and cover multiple customers, which is normal. But if you see an old domain of your own that should have been retired, that is a sign your configuration needs cleaning up.
Can this check an internal server?
No. Private network addresses such as 192.168.x.x and 127.0.0.1 are blocked deliberately, so that the tool cannot be used to probe services running inside the server that hosts it. Internal hosts have to be checked with a command-line tool from inside that network.