SSL certificate checker
What certificate a site serves, and how long it has left.
Free and no signup. This one fetches the URL from our server; nothing about it is stored.
This one runs from our server rather than your browser, so the address does leave your machine. Nothing about it is stored.
About this tool
Certificate expiry is a scheduled outage that nobody schedules. Renewal is automated almost everywhere now, which is precisely why it fails silently: the automation breaks in March and nobody finds out until the certificate lapses in June and every visitor gets a full-page browser warning.
- The handshake deliberately does not verify, because the whole point is to inspect certificates that are expired, self-signed or issued for the wrong name. Validity is judged from the certificate afterwards.
- A name mismatch is as bad as an expiry. A certificate for example.com does not cover www.example.com unless the name is listed, and a wildcard covers one label only.
- Under fourteen days remaining is the point to check that your renewal automation still runs, rather than the point to renew by hand.
- The negotiated protocol is shown. TLS 1.0 and 1.1 are deprecated and refused by current browsers.
Questions
- How do I check when an SSL certificate expires?
- Enter the domain here — the expiry date and days remaining come from the certificate the server actually presents, not from what your dashboard claims.
- Does a wildcard certificate cover subdomains of subdomains?
- No. A wildcard covers exactly one label, so *.example.com matches www.example.com but not a.b.example.com.
- What if the chain is untrusted?
- Usually a missing intermediate certificate. Browsers on desktop often paper over it from cache while mobile clients fail outright, which is why it can look fine to you and broken to your users.