Free tool

SSL certificate checker

Enter a website’s address to check its SSL certificate: whether browsers will trust it, which names it covers, who issued it and when it expires.

How to read the results

Valid: Browsers will trust the certificate: it’s in date, it covers this hostname and it chains back to a trusted certificate authority. If it isn’t valid, we say why.
Names covered: Every hostname the certificate is issued for. A wildcard such as *.example.com covers one level of subdomain, like blog.example.com, but not example.com itself.
Issuer: The certificate authority that signed it. A certificate the site signed itself (self-signed) isn’t trusted by browsers.
Valid from, valid to and days left: Certificates last a limited time and must be renewed before the end date. We warn when fewer than 30 days are left.
TLS version and cipher: How this connection was encrypted. TLS 1.3 and TLS 1.2 are current; anything older should be switched off on the server.

Frequently asked questions

My certificate renews automatically. Why does it say it expires soon?

Free certificates are often valid for 90 days, and renewal tools usually renew them with about a month to go. Seeing fewer than 30 days left can mean renewal has failed, so check your host’s SSL settings or your renewal logs.

What does a hostname mismatch mean?

The certificate doesn’t list the name you checked. A common case is a certificate for example.com that doesn’t include www.example.com, or the other way round. Reissue the certificate with both names.

What is an untrusted or incomplete chain?

A certificate is trusted when it links back to an authority browsers already know, through one or more intermediate certificates. If the server doesn’t send the intermediates, or the certificate is self-signed, many browsers and apps refuse the connection. Installing the full chain from your certificate provider fixes it.

Does it check mixed content or other ports?

No. It connects to port 443, the standard HTTPS port, and checks the certificate the server sends there. It doesn’t scan the page for images or scripts loaded over plain http://.

Is it safe to check someone else’s site?

Yes. The checker makes one ordinary HTTPS connection, just as a browser does, and reads the certificate the server sends to everyone.