Free SSL Checker: Check SSL Certificate Validity

SSL TLS
Quick select:
Checking the SSL certificate…
Your IP:
Your Country:

SSL checks

Check Result Details

Certificate details

Certificate chain

Certificate Issued By Expires Key

Enter a domain to see the SSL certificate its website is using, who issued it, when it runs out and whether browsers will trust it.

SSL Certificate Checker Overview

What is an SSL certificate?

An SSL certificate is what puts the padlock next to a web address. Strictly speaking it is a TLS certificate these days, but almost everyone still calls it SSL. It does two jobs. It shows visitors that they have reached the real site and not an impostor, and it lets the browser encrypt everything sent to and from the site. Certificates are issued by certificate authorities such as Let's Encrypt, DigiCert and Sectigo. Each one names the domains it is valid for and has a fixed end date. When something is wrong with it, the browser puts up a full-page warning instead of the site, and most people close the tab.

What does this SSL checker look at?

We connect to the site on port 443, the same port your browser uses, and read the certificate it hands over. From there we check that browsers would trust it, that it covers the exact name you typed and how many days it has left. We also look at whether the server sends the intermediate certificate along with its own, which is the step people most often get wrong. Below the checks you will find the full details: TLS version and cipher, key type and size, signature algorithm, serial number, fingerprint and each certificate in the chain.

What is the certificate chain?

Browsers only trust a short list of root certificates. Your certificate is not signed by a root directly. It is signed by an intermediate certificate, and the root signs the intermediate. For the browser to link your certificate back to a root, your server has to send the intermediate too. If it doesn't, desktop Chrome can often fill the gap on its own, but phones, apps, scripts and mail servers usually refuse the connection, even though there is nothing wrong with the certificate itself.

When should I check my SSL certificate?

Run a check after you install or renew a certificate, after moving the site to a new server or CDN, and any time someone tells you they are seeing a security warning. Certificates are being issued for shorter periods every year, so it also pays to confirm that automatic renewal is actually working, well before the end date.

FAQs

It does what your browser does when you open the site: it makes a secure connection and reads the certificate. The difference is that it shows you everything the browser checked, so you can spot a problem before your visitors do.

Usually because the server is not sending the intermediate certificate. Your certificate provider or hosting panel gives you a file called the CA bundle or fullchain.pem. Install it alongside the certificate and the warning goes away.

Since 15 March 2026 a public SSL certificate can last at most 200 days. That drops to 100 days in March 2027 and to 47 days in March 2029, so certificates really need to renew themselves. Let's Encrypt certificates last 90 days and are renewed automatically by most hosts.

Only if both names are listed in it. The checker shows every name the certificate covers. Keep in mind that a wildcard like *.example.com covers one level of subdomains, but not example.com on its own.

The encryption is the same for all three. What changes is how much the issuer checked before handing it over. A DV certificate only proves you control the domain, an OV certificate also confirms the company behind it, and an EV certificate goes through a stricter identity check.

SSL Troubleshooting & Practical Fixes

The certificate passed its end date. Browsers block the site with a security warning until a new certificate is installed.

How to fix: Renew the certificate with your provider or hosting panel, install it on the server and reload the web server. For free certificates, check that the automatic renewal job (for example certbot or AutoSSL) is running and has not been failing.

The certificate is valid, but the server sends it alone. Desktop browsers sometimes cope, while phones, apps, scripts and other servers report it as not trusted.

How to fix: Install the full chain, often supplied as fullchain.pem or a CA bundle file, instead of only the certificate file. Run the check again until the chain shows as complete.

The name you checked is not listed in the certificate, so browsers warn that the site may be an impostor. A common case is a certificate for example.com used on www.example.com, or the other way round.

How to fix: Issue a certificate that lists every name the site answers on, such as both example.com and www.example.com, or use a wildcard certificate for many subdomains. Then install it on the server.

The certificate was signed by the server itself rather than by a trusted authority, so no browser trusts it.

How to fix: Replace it with a certificate from a public certificate authority. Free, automatically renewed certificates are available from Let's Encrypt and most hosting panels.