Skip to content
Utilboxes

SSL Certificate Checker

Enter a domain to see exactly when its SSL certificate expires, who issued it, and whether browsers and apps will trust it.

Checked by this site's server

How to use the SSL Certificate Checker

  1. 1Type the domain, such as example.com, or paste a full address.
  2. 2Leave the port at 443 for a website, or choose the port of a mail or other TLS service.
  3. 3Press Check certificate.
  4. 4Read the expiry date and any chain or name problems, and add a renewal reminder to your calendar if you like.

How it works

Browsers do not let web pages see certificate details, so this check runs on this site's server. It opens a TLS connection to the domain as a browser would — sending the domain name so the server presents the right certificate — reads the certificate and the chain the server sends, and closes the connection. Nothing about the check is stored.

Three things must all be right for a certificate to work. It must be within its validity dates; it must name the domain being visited, either exactly or through a wildcard such as *.example.com; and it must chain up to a root certificate authority that devices trust. The tool checks all three, verifying the chain against the root certificates bundled with Node.js, which follow Mozilla's trusted list.

The most common problem after expiry is a missing intermediate certificate. Desktop browsers can often fetch the missing piece themselves, so the site looks fine in Chrome while phone apps, API clients, payment providers and older devices refuse to connect. A chain error is worth fixing even when your browser shows a padlock.

Public certificate lifetimes are being shortened in stages under CA/Browser Forum rules — to a maximum of 200 days from March 2026, falling to 47 days by 2029 — so automated renewal and regular expiry checks matter more each year. Before connecting, every address the domain points to is checked to be on the public internet, so the tool cannot be used to probe private networks.

Frequently asked questions

When should I renew my certificate?
With at least two weeks to spare. Automated clients such as Certbot for Let's Encrypt try to renew when about 30 days remain, so a certificate with fewer than 30 days left often means automatic renewal has stopped working.
Why does my browser show a padlock when this tool reports a chain problem?
Browsers can fill in a missing intermediate certificate from their cache or by downloading it. Many other clients cannot, so they fail where the browser succeeds. Configure your server to send the full chain.
Can it check mail servers?
Yes, on ports that use TLS from the first byte: 465 for SMTP, 993 for IMAP and 995 for POP3. Ports that upgrade a plain connection with STARTTLS, such as 25 and 587, are not supported.
Is the domain I check stored?
No. The domain is sent to this site's server only to make the connection, and the result goes straight back to your browser without being saved.

Related tools

Email Address ValidatorCheck email address format with plain-English errors, typo fixes and MX lookups.Open Graph PreviewPreview how a link looks when shared, and check or write its Open Graph tags.Robots.txt Generator and TesterBuild a robots.txt file and test which URLs each crawler may fetch.GeneratorsFile Checksum VerifierCalculate MD5, SHA-1, SHA-256 or SHA-512 and compare with a published hash.