SSL certificate checker
The certificate a host actually serves, its chain, and when it expires.
A TLS certificate is a signed statement that the name you typed belongs to the server answering you. This checker opens a connection to the host, completes the handshake, and shows exactly what came back: the certificate, everyone who signed it, and how long it has left.
What makes a certificate valid
Three things have to hold at once. It must cover the hostname you asked for, which is a list inside the certificate rather than the name of the file. It must be inside its validity window. And it must chain, through intermediate certificates the server is expected to send, up to a root your system already trusts. A failure of any one is enough for a browser to refuse the page, so all three are reported separately here rather than collapsed into a padlock.
Why certificates expire so quickly now
Public certificates are issued for months rather than years, and the trend is towards shorter still. A short life limits how long a stolen key is useful, and forces the renewal to be automated — which is the point. Almost every outage caused by a certificate is a renewal that was left to a person to remember, so this page shows the days remaining plainly and marks the last three weeks.
What the chain tells you
Servers must send the intermediates between their own certificate and the root. A chain that looks fine in a browser can still be incomplete: browsers quietly fetch missing intermediates, while many other clients — payment terminals, older Android, command-line tools — do not, and simply fail. The chain shown here is the one the server actually sent, which is why it is worth checking after any certificate change.
Common questions
Why does my browser trust a certificate this page marks as untrusted?
Usually because your browser or operating system carries a root this server does not, or because it fetched a missing intermediate for itself. The check here uses the trust store of our server and reports the chain exactly as it was served, which is closer to what a non-browser client will see.
My certificate is valid but the site still warns. Why?
Most often the name: a certificate for example.com does not cover www.example.com unless both are listed in it. The names covered are shown above, and a mismatch is called out separately from expiry and trust.
Can I check a host on a non-standard port?
This checker connects to 443 only. Restricting the ports it will open is what keeps it from being used to probe arbitrary services on someone else's network.
Does checking a certificate reveal anything about me?
The host you check sees a connection from our server, not from you. We keep no record of what was checked.