SSL Checker
Check whether a site's SSL/TLS certificate is valid, who issued it and when it expires.
Looks up live data What you enter is sent to our server to fetch live results from public sources. Results are cached briefly. A Cloudflare Turnstile bot check runs when you press the button (it loads a script from challenges.cloudflare.com and may show a short challenge).
A Cloudflare Turnstile bot check runs when you press the button (it loads a script from challenges.cloudflare.com and may show a short challenge).
Report a problem with this tool
About this tool
Enter a domain to see whether its HTTPS certificate is accepted right now. The tool makes a real HTTPS request from our server, which only succeeds if the certificate chain is trusted, matches the hostname and is within its validity dates. It also reads the HSTS header and, where available, the latest certificate's issuer, validity dates and days remaining from public Certificate Transparency logs. It checks the public HTTPS endpoint on port 443 only.
How to use it
- Enter a domain such as example.com (no https:// needed).
- Press Check SSL certificate.
- Read the result: valid or not, HSTS setting, issuer and days until expiry.
- If it is invalid, use the common problems below to find the cause.
Why a certificate fails
- Expired
- The end date has passed. Usually an automatic renewal that stopped working.
- Wrong hostname
- The certificate does not list the name you visited. A certificate for example.com does not cover www.example.com unless both are listed, and *.example.com covers www.example.com but not example.com itself or a.b.example.com.
- Incomplete chain
- The server does not send the intermediate certificate. Some browsers fill the gap themselves, so the site can work for you and still fail elsewhere.
- Self-signed or private CA
- Not issued by a publicly trusted authority, so public clients reject it.
- No HTTPS on port 443
- The server refuses or closes the connection, so there is no certificate to check.
Reading the result
- Valid
- Comes from a real HTTPS request made by our server. It only succeeds when the chain is trusted, the name matches and the dates are current.
- HTTP status
- The status of that request. Redirects are not followed, so a 301 or 302 here is normal.
- HSTS
- The Strict-Transport-Security header, if the site sends one. max-age is in seconds.
- Certificate
- The most recent certificate for this name in public Certificate Transparency logs. It can differ from the one the server sends right now, for example a renewed certificate that is not installed yet.
See the exact certificate a server sends
Click the padlock in your browser and open the certificate details, or run openssl from a terminal. To read a certificate file in detail, paste it into the Certificate & CSR Decoder.
openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -subject -issuer -dates
Common problems
- Result says the connection failed or the certificate is not trusted
- The certificate may be expired, issued for a different hostname, missing an intermediate certificate, or the site may not offer HTTPS.
- Certificate details are unavailable
- The Certificate Transparency lookup is best-effort and can time out. The valid/invalid verdict comes from the live connection and is still reliable.
- Only a few days remain
- Renew now. Most certificates renew automatically; check that your renewal job is running.
Frequently asked questions
Does this check subdomains and other ports?
It checks the exact hostname you enter on the standard HTTPS port (443) only.
What does HSTS mean?
HTTP Strict Transport Security tells browsers to always use HTTPS for your site. "not set" means the header was not sent.
Is an SSL certificate the same as a TLS certificate?
Yes. TLS replaced SSL as the protocol years ago, but the certificates are still commonly called SSL certificates. It is the same certificate.
My browser shows a padlock but this check fails. Why?
Your browser may have filled in a missing intermediate certificate or reached a different server. Fix the server so it sends the full chain, because other clients, apps and bots will fail the same way.