Check SSL Certificate

Check SSL Certificate: Issuer, Expiry and Chain

This tool connects to a domain on port 443 and lists every certificate the server sends. For each one you get the issuer, the valid-from and valid-to dates, the time left before expiry, the serial number and the signature hash algorithm. The first entry is the site's own certificate; the rest are intermediates in the chain.

SSL or TLS?

People still say "SSL certificate", but SSL itself is gone. Browsers and servers use TLS 1.2 and TLS 1.3. The certificate format (X.509) stayed the same, so the old name stuck.

What to Look For

• Expires In: renew before this reaches zero. An expired certificate puts a full-page warning in front of visitors.
• Chain: you should see at least one intermediate after the primary certificate. A server that sends only its own certificate works in some browsers and fails in others, and in many API clients.
• Issuer: confirms which CA signed the certificate, such as Let's Encrypt, Google Trust Services, DigiCert or Sectigo. An unexpected issuer can point to a forgotten CDN or proxy in front of the site.
• Algorithm: current certificates use SHA-256 or stronger. Browsers rejected SHA-1 certificates years ago.

Validation Levels

1. Domain Validated (DV): the CA checks that you control the domain. Let's Encrypt issues these for free, and most sites use them.
2. Organization Validated (OV): the CA also checks the company behind the domain. The details appear inside the certificate.
3. Extended Validation (EV): stricter company checks. Browsers removed the green address bar for EV in 2019, so visitors see the same padlock as with DV.

Wildcard certificates (*.example.com) cover one level of subdomains. They don't cover the bare example.com unless it's listed as a second name.

Certificate Lifetimes Are Getting Shorter

Public certificates issued since March 15, 2026 can be valid for at most 200 days. The CA/Browser Forum limit drops to 100 days in March 2027 and 47 days in March 2029. If you still renew by hand, switch to automated renewal through ACME (Certbot, acme.sh, or your host's built-in option).

This tool reports what the server sends. It doesn't check revocation or whether the certificate name matches the domain, so confirm those in a browser or with openssl s_client if something looks wrong.