SSL Certificate Checker

Is your SSL certificate valid and trusted?

Expiry, issuer, covered names, chain and TLS version of any public site, with plain-language fixes.

Domain name

For example example.com, without https:// or a path.

Port

Certificate

Not checked yet

Enter a domain name and press Check.

Valid until
Issued by
Names covered
Certificate chain
TLS version

How to use

Type the site's domain name, such as example.com, without https:// or a path.
Keep port 443 for a website; pick another port to check a mail or directory server.
Press Check. The verdict, days left and anything to fix appear at once; the details below list the names covered, the issuer and the chain.

How it works

A certificate is a site's ID card: it says which names the site may use, and a certificate authority signs it so others can trust it. When you open a site over HTTPS, your browser checks three things before it shows the padlock: the dates (is the certificate valid today), the chain (does the signature lead to an authority it trusts) and the name (does the certificate cover the address you typed). The checker connects to the site the same way, reads its certificate and makes the same checks, plus the TLS version.

Days left = (end of validity − now) ÷ 24 hours, rounded down. A certificate valid until 1 January 2027 at 00:00 UTC has 85 days left when checked on 7 October 2026 at noon. Public certificates are short-lived (at most 398 days, and getting shorter), so renewal should be automatic; tools like Let's Encrypt's renew when 30 days are left, which is why fewer than 14 days left is a warning.

The check runs once, from our server, to one of the site's addresses. A site behind several servers or a CDN may show a different certificate elsewhere, and revocation is not checked. Sources: RFC 5280 (validity), RFC 6125 (names), RFC 8446 and RFC 8996 (TLS versions).

Frequently asked questions

Why does my browser say the site is not secure when the certificate is valid?

Usually the chain is incomplete, the certificate doesn't cover the exact name you typed (www versus no www), or the page loads parts over plain http. The checks here cover the first two.

What is an incomplete chain?

Your certificate is signed by an intermediate certificate, which the server should send along. If it doesn't, some browsers fetch it themselves, but many apps and older devices fail. Install the full chain file from your certificate authority.

How often should a certificate be renewed?

Before it expires, and automatically. Public certificates last at most 398 days, and the limit is shrinking; automated clients renew a month before the end.

Can I check a mail server?

Yes, on ports where TLS starts at once: 465, 993 and 995. Ports that switch to TLS later with STARTTLS (25, 587, 143, 110) are not supported.

What does NET::ERR_CERT_DATE_INVALID mean?

The certificate has expired or isn't valid yet. If the checker shows valid dates, the clock of the device showing the error is probably wrong.

What does NET::ERR_CERT_COMMON_NAME_INVALID mean?

The certificate doesn't cover the address you opened, often www versus no www or a subdomain. The checker lists every name the certificate covers.

What does NET::ERR_CERT_AUTHORITY_INVALID mean?

The browser can't trace the certificate to an authority it trusts: it is self-signed, issued by a private authority, or sent without its intermediate certificate.

Which TLS version should a site use?

TLS 1.3, with TLS 1.2 as the fallback. TLS 1.0 and 1.1 are deprecated (RFC 8996), and current browsers refuse them.

More in Web & developer

All 18 utilities in Web & developer