How to check an SSL certificate before your users do
A free tool to check any domain's SSL certificate: expiry date, issuer, chain, and the hostnames it covers, plus what each result actually means.
An SSL certificate quietly expires on a Saturday, and by Monday morning every visitor meets a full-page browser warning instead of your homepage. Nothing crashed. No alert fired. The certificate reached its end date, browsers stopped trusting the connection, and the site was effectively down.
We built a free SSL certificate checker so you can see exactly what a domain is serving, in one step.
Check any certificate in one step
Type a domain (example.com, no https:// needed) and you get back the certificate the server presents to browsers right now. No account, no install, no rate-card. The result lives at its own URL, so you can share a report with a colleague and they see the same thing.
Reading the results
The report answers the questions you actually have when something looks off.
The expiry date, and how many days are left. This is the number worth putting a reminder against.
Who issued the certificate, and the full chain from the leaf up to the root. A missing intermediate is a common reason a certificate works in your browser but fails in someone else’s.
Every hostname the certificate covers, pulled from its Subject Alternative Names. If one certificate serves both www. and the apex, both should be listed. If api. isn’t there, that’s why the API call is failing.
The negotiated TLS version and the certificate’s key, so you can spot a server still stuck on an old protocol.
And two things browsers and search engines care about: whether the plain http:// address redirects to https://, and whether the site sends an HSTS header telling browsers to always use the secure version.
When a certificate is expired, self-signed, or doesn’t cover the hostname you asked about, the report says so in plain language instead of a raw error string.
Why certificates expire on you
Certificates are short-lived on purpose (many now last 90 days), and renewal is usually automated. Automated until the cron job silently fails, the ACME client loses its credentials, or the one certificate nobody wired up for auto-renewal comes due. The failure stays invisible right up to the moment it isn’t, because nothing in your own stack went down.
Checking by hand catches the certificate you remembered to check. It’s the one you forgot that takes the site offline.
Stop checking by hand
Run a check whenever you need one; it’s free and there’s no limit. When you want to stop doing it manually, monitor the domain with Uptimeprobe and get told before a certificate lapses, alongside the rest of your uptime. See what’s included on every plan.