🔒 SSL/TLS Certificate Checker
Check any website’s SSL/TLS certificate. Expiry date, issuer, subject, SANs, negotiated TLS version and the full certificate chain. Green means valid, amber means renewal is due within 30 days, red means expired or unreachable. Handy for BDIX sites too: hosts on private 10.x IPs often can’t be validated by a browser the usual way, and this tool shows exactly what certificate they present.
Enter a domain. Green means the certificate is currently valid; amber means it expires within 30 days; red means it is expired or unreachable. Renew anything in amber soon.
How This SSL Checker Works
Our server opens a TLS connection to the host on port 443, negotiates the handshake, and reads the certificate (and its chain) that the site presents. It then decodes the certificate to report the subject, issuer, validity window, SANs and signature algorithm, plus the TLS version that was actually negotiated.
This is an inspection of what the server presents, not a full trust-path validation against a browser root store. So use it to monitor expiry and spot configuration problems, not as a security verdict.
When to Check a Certificate
- Before a certificate expires, to schedule renewal ahead of the deadline.
- After deploying HTTPS, to confirm the right certificate is being served.
- When users report “not secure” warnings, to find out which name or expiry is wrong.
- To verify a certificate actually covers www and bare domains (SANs).
- To confirm an older TLS version has been disabled and 1.2/1.3 is in use.
FAQ (Frequently Asked Questions)
What Does an SSL/TLS Checker Do?
It connects to a site over HTTPS, reads the certificate it presents, and reports when it expires, who issued it, which names it covers, and which TLS version was negotiated. It helps you catch expiring or misconfigured certificates before users see a browser warning.
How Many Days Before Expiry Should I Renew a Certificate?
Aim to renew at least 30 days before expiry. That leaves time for delays, mistakes, or a slow certificate authority. This tool flags certificates expiring within 30 days in amber and already-expired ones in red.
What Does “the Certificate Is Valid for” (SAN) Mean?
The Subject Alternative Name (SAN) list is the set of domains the certificate is allowed to secure. If the domain you are visiting is not in that list, browsers show a warning even if the certificate is otherwise valid.
What Is a Certificate Chain?
The chain is the path from the site’s own certificate up through intermediate certificates to a trusted root. Every link must be present and valid. A broken chain causes browser errors on some devices even when the site works on others.
Which TLS Version Is Good?
TLS 1.3 is current and fastest; TLS 1.2 is still secure and widely supported. Anything older (TLS 1.1, 1.0, SSLv3) is obsolete and should be disabled.
Does This Tool Tell Me If a Site’s Identity Is Trusted?
It reads and reports the certificate, but it does not perform full trust-path validation against a browser root store. Treat it as an inspection of expiry and configuration, not a security verdict.