SSL Checker
Check a website's SSL certificate: expiry date, issuer, name match, missing intermediates and TLS version, with the full certificate chain explained.
Something not working, or missing a feature? Send feedback
About the SSL Checker
The SSL Checker connects to a website on port 443 and reads its certificate: who issued it, when it expires, which names it covers, and whether the full chain verifies against the root certificates browsers trust. It also shows the TLS version and explains problems such as a missing intermediate certificate in plain English.
Our server opens one HTTPS connection to the site to read its certificate, without loading the page. Host names and results are not stored.
How to use the SSL Checker
- Enter a domain such as example.com (a full URL works too).
- Click Check SSL.
- Read the findings: expiry, name match, chain trust and TLS version.
- Open the chain to see every certificate, its issuer, key and validity.
Common mistakes
- Renewing without reloading. A renewed certificate only takes effect after the web server reloads it. If the checker still shows the old expiry date, reload nginx or Apache.
- Checking only the root domain. www, api and mail hosts may use different certificates. Check each host name your users visit.
Works well with the SSL Checker
- DNS Lookup: check CAA records and where the domain points.
- Website SEO Checker: audit the HTTPS page itself.
- Redirect Checker: make sure http:// redirects to https://.
Frequently asked questions
Why does my site work in Chrome but fail in other tools?
Usually a missing intermediate certificate. Desktop browsers often fill the gap from their cache, but API clients, older phones and crawlers cannot. Install the full chain (fullchain.pem with Let's Encrypt).
How long are certificates valid?
Public certificates are getting shorter-lived: since March 2026 the maximum is 200 days, and it falls to 100 days in 2027 and 47 days in 2029. Let's Encrypt certificates last 90 days. Automate renewal instead of renewing by hand.
What does "name mismatch" mean?
The certificate does not list the host you visited, for example a certificate for example.com served on shop.example.com. Add the name to the certificate, or use a wildcard (*.example.com) for subdomains.
Which TLS versions should a server support?
TLS 1.2 and TLS 1.3. Browsers no longer accept TLS 1.0 and 1.1.
Related tools
Website SEO Checker
Check any page for on-page SEO problems: title, meta description, headings, canonical, robots.txt, noindex, structured data, alt text, HTTPS and speed, with a score.
Broken Link Checker
Find broken links on any web page: every internal and external link (and optionally image) is checked for 404s, server errors, timeouts and redirects. Export a CSV.
Redirect Checker
Check the HTTP status code and full redirect chain of up to 100 URLs: 301, 302, 404 and 5xx, response headers, loops and HTTPS downgrades, with fixes and CSV.
HTTP Status Checker
Check the HTTP status code of up to 100 URLs: 200, 301, 404, 500 and more, with what each means for SEO and a searchable list of every status code.
AdSense Readiness Checker
Check if your site is ready for Google AdSense: privacy policy, About and Contact pages, ads.txt, crawler access, thin pages, content risks and consent, before you apply.
Site Audit Tool
Crawl your website (up to 100 pages) and find broken pages, duplicate titles and descriptions, missing H1s, redirects, noindex, thin and slow pages. Export a CSV.