Check any website’s SSL certificate in seconds. Enter a domain to see if its certificate is trusted, which names it covers, the full certificate chain, the TLS version and exactly how many days are left before it expires. Free, no sign-up.
What the SSL checker tests
- Expiry: the exact expiry date and days left, with a warning under 14 days.
- Trust: whether the chain verifies against the same root certificates browsers use.
- Name match: whether the certificate covers the exact name you entered, including wildcards.
- Chain: your certificate, the intermediate and the root, shown as a diagram.
- Protocol and key: TLS version, cipher, key type and size.
How to fix the most common SSL errors
- Certificate expired: renew it, then check why automatic renewal failed (a blocked port 80, a firewall or a DNS change are the usual causes).
- Name mismatch: issue a new certificate that lists every name visitors use, for example both
example.comandwww.example.com. - Chain not trusted: install the full chain (
fullchain.pemfor Let’s Encrypt), not only the site certificate, then reload the web server. - Self-signed certificate: replace it with a free Let’s Encrypt certificate; browsers never trust self-signed ones.
If the domain does not load at all, check its records with the DNS lookup tool first. Stuck? Tell us what is broken and we will help.
Check a certificate from the terminal
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -subject -issuer -dates -ext subjectAltNameThe notAfter line is the expiry date and subjectAltName lists every name the certificate covers.
Frequently asked questions
How do I check if an SSL certificate is valid?
Enter the domain in the checker above. It connects to the site the way a browser does and tells you whether the certificate is trusted, covers that exact name, and has not expired. A valid certificate shows a green result with the number of days left.
How do I see when an SSL certificate expires?
The checker shows the expiry date and a days-left gauge. From a terminal you can run: openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -dates. The notAfter line is the expiry date.
Why does my browser say the certificate is not trusted when it has not expired?
The most common cause is a missing intermediate certificate: the server sends only the site certificate instead of the full chain. Install the full chain (for Let's Encrypt that is fullchain.pem) and restart the web server. A self-signed certificate or a name mismatch causes the same warning.
What does "certificate name mismatch" mean?
The certificate was issued for different names than the one you visited, for example for www.example.com but not example.com. Issue a new certificate that includes every name visitors use; the checker lists all names the current certificate covers.
How long is a Let's Encrypt certificate valid?
Let's Encrypt certificates are valid for 90 days, and shorter lifetimes are being phased in. They are meant to renew automatically about 30 days before expiry, so if the checker shows fewer than 14 days left, automatic renewal has probably failed.
Can I check the certificate of a mail server?
Yes. Choose port 465 (SMTPS), 993 (IMAPS) or 995 (POP3S) and enter the mail server name, for example mail.example.com.
Is this SSL checker free and private?
Yes. It is free with no sign-up. We connect to the site only to read its public certificate, keep the result for up to five minutes so repeat checks are fast, and do not store the domains you check.