SSL Certificate Checker
Enter a domain and see the SSL certificate's expiry date, issuer, and which domains it covers. Useful for catching certificates about to expire before they cause downtime.
Enter any domain to check its live SSL/TLS certificate. A direct TLS handshake is made server-side, so you get real-time data straight from the certificate, not cached logs.
How to check an SSL certificate
Enter a domain to see who issued its certificate, which names it covers and when it expires.
- 01
Enter the domain, not a full URL
Type example.com or shop.example.com. Each subdomain can have its own certificate, so check the exact host your visitors use.
- 02
Read the expiry and days remaining
The tool shows the valid-from and valid-to dates, and how many days are left. Under 30 days is flagged as expiring soon; zero or less as expired.
- 03
Check the names it covers
The subject alternative names (SANs) list every hostname the certificate is valid for. If the host you typed isn't in the list, or matched by a wildcard, browsers will reject it.
How the certificate is read
Our server opens a TLS connection to the domain on port 443, sending the domain name as SNI so a server hosting many sites returns the right certificate. It reads the certificate the server presents and reports the subject, issuer, validity dates, SANs, serial number and SHA-256 fingerprint. If there's no answer within 10 seconds, the check times out.
The connection deliberately accepts any certificate, so you can inspect expired or self-signed ones that a browser would refuse. That also means the tool doesn't tell you whether the certificate chains to a trusted authority, or whether intermediate certificates are missing. A green expiry date here isn't a full guarantee that every browser will accept the site.
How long certificates last now
Certificate lifetimes are shrinking on a schedule agreed by browsers and certificate authorities in 2025, so a habit of renewing once a year no longer works.
| Certificates issued | Maximum validity |
|---|---|
| Before 15 March 2026 | 398 days |
| From 15 March 2026 | 200 days |
| From 15 March 2027 | 100 days |
| From 15 March 2029 | 47 days |
Let's Encrypt certificates already last 90 days. With lifetimes this short, automatic renewal through your host or an ACME client such as Certbot is the only sensible approach. Use this checker to confirm the renewal actually happened, especially after changing servers or DNS.
What each field in the result means
The result shows the parts of the certificate you're most likely to need. Here's what each one is for.
| Field | What it tells you |
|---|---|
| Subject (common name) | The main name the certificate was issued for, a legacy field |
| Issuer | The organisation and intermediate that signed it, such as Let's Encrypt · R11 |
| Valid from / valid to | The window in which browsers accept it, in UTC |
| Days remaining | Whole days until valid-to, rounded up |
| Subject alternative names | Every hostname the certificate covers, including wildcards |
| Serial number | The issuer's unique ID for this certificate, used when revoking it |
| SHA-256 fingerprint | A hash of the whole certificate, handy for checking two servers serve the same one |
The fingerprint is the quickest way to spot a server behind a load balancer that missed a renewal: check the domain a few times and compare. If two different fingerprints come back, one of the servers is still serving the old certificate.
When to check a certificate
Confirming an automatic renewal worked
Check a few days after the renewal date. If days remaining didn't jump back up, the renewal job failed and needs attention.
Checking a new certificate after install
Make sure the new expiry date is live and that every hostname you need, such as www and the bare domain, is in the SANs.
Testing whether a wildcard covers a host
A *.example.com certificate covers api.example.com but not example.com itself, and not v2.api.example.com. The SAN list makes this clear.
Investigating a "not secure" report
If a visitor sees a certificate warning, check expiry and SANs first. They're the two most common causes.
What this checker doesn't test
- Chain trust and missing intermediates, as explained above. For a full audit, SSL Labs' server test grades the whole configuration.
- Ports other than 443. Mail servers and custom ports aren't checked.
- Which TLS versions and ciphers the server allows.
- Revocation. A certificate that's been revoked but hasn't expired still looks valid here.