How to use the SSL Checker
- Enter a domain name such as
example.com(a full URL is fine — only the hostname is used). - Press Check SSL. We open a TLS connection on port 443 and read the certificate the server presents.
- Read the verdict and the days-left counter: green is fine, amber means under 30 days, red under 14 days or expired.
- Review issuer, covered hostnames (SANs), TLS version and the certificate chain to spot misconfigurations.
What does an SSL checker do?
An SSL (more precisely TLS) certificate proves that a server is allowed to use a domain name and enables the encrypted HTTPS connection. This checker connects to the server like a browser would, reads the certificate chain and tells you whether it is trusted, valid for the hostname and not expired — the three things that make browsers show the padlock instead of a full-page warning.
What the results mean
- Days left: Let’s Encrypt certificates last 90 days and are renewed automatically around day 60. For all public certificates the CA/Browser Forum is shortening the maximum lifetime in steps — 200 days since March 2026, 100 days from March 2027 and 47 days from March 2029 — so automated renewal (ACME) is becoming essential. A counter below 30 days on an auto-renewing certificate usually means renewal is failing.
- Subject Alternative Names (SANs): the hostnames the certificate covers.
example.comandwww.example.comare separate names; a wildcard*.example.comcovers one level of subdomains but not the bare domain ora.b.example.com. - Chain: the leaf certificate, one or more intermediates and the root. Servers must send the intermediates; a missing one causes “unable to verify the first certificate” errors in some clients even if desktop browsers work.
- Protocol & cipher: TLS 1.3 or 1.2 are fine. TLS 1.0 and 1.1 are deprecated and blocked by modern browsers.
Common SSL errors and fixes
| Error | Cause | Fix |
|---|---|---|
| CERT_HAS_EXPIRED | Renewal failed or was forgotten | Renew and reload the web server; check your cron/ACME client |
| Hostname mismatch | The name isn’t in the SANs (often www missing) | Reissue the certificate including every hostname you serve |
| UNABLE_TO_VERIFY_LEAF_SIGNATURE | Intermediate certificate missing | Install the full chain (fullchain.pem), not just the leaf |
| SELF_SIGNED_CERT | Self-signed or internal CA | Use a public CA such as Let’s Encrypt for public sites |
SSL and SEO
HTTPS is a lightweight Google ranking signal, and an invalid certificate blocks visitors and crawlers entirely. After fixing certificates, make sure all HTTP URLs 301-redirect to HTTPS with the Redirect Checker, and add an HSTS header — the Security Headers Checker verifies it.
Tools that pair well with the SSL Checker
- DNS Lookup — Query all common DNS record types for a domain in one go, with TTLs, sorted MX records and an SPF/DMARC email-authentication summary.
- Website Down Checker — Find out in seconds whether a website is down for everyone or just for you — with status code, response time and troubleshooting tips.
- HTTP Header Checker — Fetch any URL and see exactly what the server sends back — status code, redirect chain and every response header, with a plain-English explanation of the ones that matter for SEO, caching and security.
- What Is My IP — Your public IP address and everything your browser reveals to the websites you visit — user agent, screen, language, timezone and request headers.
Frequently asked questions
How do I check when an SSL certificate expires?
Enter the domain above. The tool shows the exact expiry date (“valid until”) and the number of days left, colour-coded so you can see at a glance if renewal is due.
Does my certificate cover www and the bare domain?
Only if both appear in the SAN list. Check the “Covered hostnames” section — if
www.example.com is missing, visitors to that address will see a certificate error.Is SSL the same as TLS?
TLS is the modern successor to SSL; SSL 2.0 and 3.0 are long obsolete. People still say “SSL certificate” out of habit, but every secure connection today uses TLS 1.2 or 1.3.
Why does the site work in my browser but the checker says the chain is incomplete?
Browsers can fetch or cache missing intermediate certificates, but many other clients (curl, Android apps, payment webhooks) cannot. Configure the server to send the full chain.
Can I check a certificate on a port other than 443?
This tool checks the standard HTTPS port 443 only. For mail servers or custom ports use
openssl s_client -connect host:port.