TR

SSL certificate checker

Connect to a domain over HTTPS and inspect the certificate it presents: who issued it, when it expires, which names it covers and whether the chain is trusted.

wikipedia.orggithub.comcloudflare.commozilla.orgbbc.co.uk

What the SSL checker inspects

The tool opens a TLS connection to port 443 of the hostname you enter, sends that hostname in the SNI extension as a browser would, and records the certificate the server returns. It shows the issuer, the subject, the validity period, the subject alternative names, the negotiated TLS version and whether the chain validates against a standard trust store. It then reads the HTTP response for a Strict-Transport-Security header.

Validity dates and renewal

A certificate is valid only between its not-before and not-after timestamps. Expired certificates remain one of the most common causes of avoidable outages, usually because an automated renewal failed silently. The result shows the days remaining so that a certificate close to expiry stands out.

Maximum lifetimes for publicly trusted certificates keep getting shorter. The industry limit dropped from 398 days to 200 days in March 2026 and is scheduled to fall further in the following years. Manual renewal is no longer realistic at that pace; automation through ACME or your provider's managed certificates is the practical answer, and monitoring is the safety net.

Hostnames: subject alternative names

Browsers match the requested hostname against the subject alternative names in the certificate and ignore the legacy common name field. A certificate for example.com does not cover www.example.com unless both are listed. A wildcard such as *.example.com covers one label only: it matches shop.example.com but not example.com itself and not a.b.example.com. A name mismatch produces the same kind of browser warning as an expired certificate.

Trust errors and what causes them

The most frequent trust failure is an incomplete chain, where the server sends its own certificate but not the intermediate that links it to a trusted root. Desktop browsers often paper over this by fetching or caching the intermediate, while API clients, mobile apps and command-line tools fail. Other causes are self-signed certificates, certificates from a private authority, expiry and hostname mismatch. The tool reports the validation error it received so you know which one applies.

Protocol version and HSTS

TLS 1.3 and TLS 1.2 are the versions in normal use. TLS 1.0 and 1.1 are deprecated and rejected by current browsers. The tool reports the version negotiated on its own connection, which reflects the best version both sides support, not the full list the server allows.

HSTS is a response header that instructs browsers to use HTTPS for the domain for a stated period, which prevents downgrade attacks on later visits. Its presence is a good sign of deliberate configuration. Be careful with includeSubDomains and preload, because they commit every subdomain to HTTPS and are slow to undo.

What a valid certificate does not mean

A trusted certificate shows that the connection is encrypted and that the certificate authority verified control over the domain name. It says nothing about who runs the site, whether the content is honest or whether the server is well maintained. Phishing sites routinely have valid certificates. The check also covers only the endpoint it reached; other ports, other subdomains and other servers behind a load balancer may be configured differently.

FAQ

How do I check when an SSL certificate expires?

Enter the hostname and read the valid-to date and the days remaining. The check uses a live connection, so it reflects the certificate the server is serving at this moment, not one that is merely issued and waiting to be installed.

Why does my browser show a certificate warning?

The usual reasons are an expired certificate, a hostname not listed in the certificate's alternative names, a missing intermediate certificate, or a self-signed or privately issued certificate. The trust result in the check names the specific validation failure.

What is the difference between SSL and TLS?

TLS is the successor to SSL. The SSL protocol versions were retired long ago and everything in use today is TLS, but the name SSL certificate stuck. The certificates are the same regardless of what you call them.

Does a certificate for example.com cover www.example.com?

Only if www.example.com is listed among the subject alternative names, or a wildcard for *.example.com is present. Most certificate authorities include both names by default, but it is not automatic.

Are free certificates less secure than paid ones?

No. The encryption is identical. Paid certificates may add organisation validation, warranties or support, none of which changes how the connection is protected or how browsers display it.

What is HSTS?

HTTP Strict Transport Security is a response header that tells browsers to connect to the site only over HTTPS for a set duration. It protects returning visitors from being downgraded to plain HTTP.

The checker says trusted but some users still see errors. Why?

Large sites serve traffic from many servers and not all of them necessarily carry the same certificate. Users may also sit behind inspection proxies, have an incorrect system clock or run an old device with an outdated trust store.