SSL Checker
An SSL checker inspects the TLS certificate your site serves — who issued it, when it expires, which hostnames it covers, and whether the chain is complete. This free tool reads your certificate and flags anything that would break browsers or lapse silently, with expiry counted to the day.
Expiry (to the day) · issuer · SAN coverage · chain · CT-log fallback
Frequently asked questions
How do I check my SSL certificate expiry date?
Enter your domain above. We read the certificate and show the exact expiry date and days remaining. A certificate under 14 days from expiry is flagged as a warning; an expired one is a failure that browsers already block.
What does an incomplete certificate chain mean?
Servers should send the leaf certificate plus any intermediate certificates. If intermediates are missing, some browsers and many API clients cannot build a path to a trusted root and reject the connection — even though the leaf itself is valid. Install the full chain to fix it.
Why does my certificate not match the domain?
A certificate only secures the hostnames listed in its Subject Alternative Names (SANs). If you browse to a name that is not covered — for example the apex when only www is listed, or a new subdomain — browsers show a name-mismatch error. Reissue the certificate with the missing name added.
How many days before expiry should I renew?
Automate renewal (ACME / Let’s Encrypt) so certificates rotate at roughly one-third of their lifetime — about 30 days before expiry for a 90-day cert. Monitoring that alerts at 14 days gives a safety net if automation fails.
My site is behind Cloudflare — is the result accurate?
When a live TLS handshake is not possible (for example a checker hosted on Cloudflare cannot socket to Cloudflare-fronted IPs), we fall back to Certificate Transparency logs and label the result "via CT logs". That gives issuer, SANs and expiry from the most recently issued certificate, but not the live chain or TLS version.