Skip to content
Utilboxes

SSL Certificate Checker

Enter a domain to see when its SSL certificate expires, who issued it, whether the name matches and whether the chain is trusted. The check runs on this site's server, because browsers cannot read certificate details, and nothing is stored. Renew with at least two weeks to spare; under 30 days left often means auto-renewal has failed.

Checked by this site's server

Updated

How to use the SSL Certificate Checker

  1. 1Type the domain, such as example.com, or paste a full address.
  2. 2Leave the port at 443 for a website, or choose the port of a mail or other TLS service.
  3. 3Press Check certificate.
  4. 4Read the expiry date and any chain or name problems, and add a renewal reminder to your calendar if you like.

How it works

Browsers do not let web pages see certificate details, so this check runs on this site's server. It opens a TLS connection to the domain as a browser would — sending the domain name so the server presents the right certificate — reads the certificate and the chain the server sends, and closes the connection. Nothing about the check is stored.

Three things must all be right for a certificate to work. It must be within its validity dates; it must name the domain being visited, either exactly or through a wildcard such as *.example.com; and it must chain up to a root certificate authority that devices trust. The tool checks all three, verifying the chain against the root certificates bundled with Node.js, which follow Mozilla's trusted list.

The most common problem after expiry is a missing intermediate certificate. Desktop browsers can often fetch the missing piece themselves, so the site looks fine in Chrome while phone apps, API clients, payment providers and older devices refuse to connect. A chain error is worth fixing even when your browser shows a padlock.

Public certificate lifetimes are being shortened in stages under CA/Browser Forum rules — to a maximum of 200 days from March 2026, falling to 47 days by 2029 — so automated renewal and regular expiry checks matter more each year. Before connecting, every address the domain points to is checked to be on the public internet, so the tool cannot be used to probe private networks.

Tips and common mistakes

  • Check both the bare domain and www, and any subdomains that serve traffic; they can use different certificates.
  • Set a reminder well before the expiry date even if renewal is automated, so a silent failure is caught in time.
  • Fix chain errors even when your own browser shows a padlock; phones, API clients and payment providers are stricter.
  • Automate renewal; certificate lifetimes are getting shorter every year.

Frequently asked questions

When should I renew my certificate?
With at least two weeks to spare. Automated clients such as Certbot for Let's Encrypt try to renew when about 30 days remain, so a certificate with fewer than 30 days left often means automatic renewal has stopped working.
Why does my browser show a padlock when this tool reports a chain problem?
Browsers can fill in a missing intermediate certificate from their cache or by downloading it. Many other clients cannot, so they fail where the browser succeeds. Configure your server to send the full chain.
Can it check mail servers?
Yes, on ports that use TLS from the first byte: 465 for SMTP, 993 for IMAP and 995 for POP3. Ports that upgrade a plain connection with STARTTLS, such as 25 and 587, are not supported.
Is the domain I check stored?
No. The domain is sent to this site's server only to make the connection, and the result goes straight back to your browser without being saved.
What is an intermediate certificate?
A certificate that links your site's certificate to a root authority that devices trust. Your server has to send it; when it is missing, some clients cannot build the chain and refuse the connection.
Do the bare domain and www need checking separately?
Yes. They can be served by different certificates or even different servers, so one can expire while the other is fine.
How long do certificates last now?
Under CA/Browser Forum rules, public certificates issued from March 2026 can last at most 200 days, falling in stages to 47 days by 2029.
Share this toolShare on XShare on FacebookShare on LinkedInShare on RedditShare by email

Guides

Related tools

Email Address ValidatorCheck email address format with plain-English errors, typo fixes and MX lookups.Open Graph PreviewPreview how a link looks when shared, and check or write its Open Graph tags.Robots.txt Generator and TesterBuild a robots.txt file and test which URLs each crawler may fetch.GeneratorsFile Checksum VerifierCalculate MD5, SHA-1, SHA-256 or SHA-512 and compare with a published hash.