Is this certificate healthy?
Enter a domain and we open a real TLS connection to it, just like a browser, then read the certificate it presents. You'll see whether it's trusted by browsers, whether it covers that exact hostname, and how many days are left until it expires, with a warning when renewal is due soon.
The details include the issuer (such as Let's Encrypt, DigiCert or Sectigo), every domain name the certificate covers, the key type, serial number and SHA-256 fingerprint, plus the complete certificate chain up to the root. Connection details show the negotiated TLS version, cipher and whether the server supports HTTP/2. Mail ports like 465 and 993 can be checked too.
How to check an SSL certificate
- 1
Enter the domain
A full URL works too.
- 2
Choose the port if needed
443 for websites.
- 3
Read the verdict
Valid and trusted, or the exact problems.
- 4
Review the chain and details
Issuer, names, dates and TLS settings.
Key features
Expiry countdown
Days remaining, with early warnings.
Trust and name checks
The same checks browsers perform.
Full chain
Server, intermediate and root certificates.
TLS details
Protocol version, cipher and HTTP/2.
Common uses
- Avoiding outages: Catch expiring certificates before visitors see warnings.
- After migrations: Confirm a new host serves the right certificate.
- Fixing browser errors: Diagnose NET::ERR_CERT and hostname mismatch errors.
Tips and good to know
- Let's Encrypt certificates last 90 days or less and should renew automatically about 30 days before expiry. If yours has under 20 days left, check your renewal job.
- See which headers the same site sends with the HTTP Header Checker.