SSL Certificate Checker
See the certificate a server really presents: when it expires, whether the chain is complete, whether it covers the name, and which TLS version it speaks. Then get an email before it expires.
What each check means
- Expiry
- Whole days until the certificate’s notAfter date. Under 30 days is a warning, under 7 is critical: if renewal is automated it should have happened by now, so something is stuck. An expired certificate makes browsers show a full-page error and makes most API clients and mail servers refuse the connection.
- Host name match
- Whether the name you checked appears in the certificate’s Subject Alternative Names. Browsers have ignored the Common Name since 2017, and a wildcard covers exactly one label: *.example.com matches www.example.com, not example.com or a.b.example.com.
- Trust and chain
- Whether the chain the server sends verifies against the public root store, and if not, why. “Incomplete” means an intermediate certificate is missing; “self-signed” means no certificate authority vouches for it at all.
- Key and signature
- The public key type and size (RSA 2048-bit or larger, or an elliptic curve key such as P-256) and the algorithm the issuer signed with. SHA-1 signatures and RSA keys under 2048 bits are no longer accepted by browsers.
- TLS version and cipher
- What this connection negotiated. TLS 1.3 or 1.2 is expected; TLS 1.0 and 1.1 were deprecated by RFC 8996 and are refused by current browsers. The checker still connects to an old server so it can tell you that.
- OCSP stapling
- Whether the server attached a signed revocation status to the handshake. Shown for information only: Let’s Encrypt stopped running OCSP in 2025, so for its certificates there is nothing to staple.
How to fix the common errors
Incomplete chain
The server sends its own certificate without the intermediate that connects it to a root. Desktop browsers often repair this quietly, which is why the site “works for me” while curl, Java, Android apps, webhooks and mail servers fail. Point the server at the full chain, not the bare certificate:
# nginx
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
# Apache 2.4.8 and later
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pemWith a commercial CA, append the intermediate (the “CA bundle”) below your certificate in the same file, leaf first. Reload the server and check again.
Name mismatch
Either the certificate does not list the name, or the server answers with a different certificate for it. The first is fixed by issuing a certificate that names every host you serve, typically both example.com and www.example.com. The second happens when a request falls through to the default virtual host: make sure the server block for this exact name has its own ssl_certificate, and that a CDN or load balancer in front of it holds a certificate for the name too.
Expired or about to expire
Renew, install and reload. With Certbot, certbot renew --dry-run shows whether automatic renewal would succeed, and systemctl list-timers shows whether the renewal timer runs at all. The most common silent failure is a renewal that succeeds on disk while the web server keeps serving the old certificate from memory until it is reloaded. That is exactly what an expiry alert catches: it reads the certificate the server presents, not the file on disk.
Self-signed or private CA
Fine for an internal test, wrong for anything public: only clients that installed your CA by hand will connect. Replace it with a certificate from a public CA; Let’s Encrypt issues them for free over ACME. Mail servers count too: a self-signed certificate on port 465, 587 or 993 makes many mail clients refuse or warn.
Related checks
- CAA record generator: limit which certificate authorities may issue for your domain.
- TLSA / DANE generator: pin your mail server’s certificate in DNSSEC-signed DNS.
- MTA-STS generator: make other mail servers require a valid certificate when they deliver to you.
- WHOIS lookup: the domain’s own expiry date, with the same free alert.
Frequently Asked Questions
What does this SSL checker test?
It opens one TLS connection to the host and port you enter, the way a browser or mail client would, and reads the certificate the server presents. It reports whether the chain verifies against the public root store, whether the certificate covers the host name, how many days are left before it expires, who issued it, the key type and size, the signature algorithm, the negotiated TLS version and cipher, and whether the server staples an OCSP response. It accepts an invalid certificate on purpose so it can tell you what is wrong with it.
My site works in Chrome, so why do curl, Android or other servers say the certificate is not trusted?
Almost always an incomplete chain: the server sends its own certificate but not the intermediate certificate that links it to a trusted root. Desktop browsers often hide this by fetching the missing intermediate themselves or by remembering it from another site. curl, wget, Java, Python, Android apps, payment providers calling your webhook and mail servers do not, and they fail. Configure the server with the full chain file (fullchain.pem for Certbot) instead of the certificate alone.
How do I fix a certificate name mismatch?
The certificate must list the exact host name in its Subject Alternative Name (SAN) extension; browsers ignore the Common Name. A wildcard such as *.example.com covers www.example.com but not example.com itself and not a.b.example.com. Request a certificate that names every host you serve, for example both example.com and www.example.com. If the right certificate is installed but a different one is served, the web server is probably answering with its default virtual host: check that the server block or virtual host for this name has its own certificate configured and that SNI reaches it.
How long is an SSL certificate valid, and when should I renew?
Let's Encrypt's default certificates last 90 days and are meant to be renewed automatically about 30 days before expiry. For all publicly trusted certificates the CA/Browser Forum (ballot SC-081) is shortening the maximum lifetime in steps: 200 days since 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Shorter lifetimes make manual renewal impractical, so automate renewal with an ACME client and alert on the expiry date in case the automation silently stops.
Can I check the certificate of a mail server?
Yes. Choose port 465 (SMTP submission over TLS), 587 (submission with STARTTLS; the checker sends EHLO and STARTTLS first), 993 (IMAPS) or 995 (POP3S). Port 25 between mail servers is not offered here because many networks filter it; the email security scan tests STARTTLS on your MX hosts instead.
Do you store the hosts I check?
A result is cached for five minutes so repeated checks of the same host do not open new connections, and a per-network counter enforces the rate limit. Nothing else is kept. If you sign up for an expiry alert, the email address and host name are stored until you unsubscribe, and the address receives nothing until you click the confirmation link.