SSL certificate checker

Enter a domain to see when its certificate expires, who issued it, and whether browsers will trust it. Free, and no account needed.

This check needs JavaScript

The check runs from your browser. Turn on JavaScript for this site, or use the command-line method described below.

Results print here

Enter a domain above. You’ll get the expiry date, days left, issuer, chain and hostname, plus when the domain registration expires.

What the result shows

Expires: The moment the certificate stops being valid, in UTC. Days left are counted in calendar days, so 0 means it expires today. After that, browsers show a full-page warning instead of the site.
Issuer: The certificate authority (CA) that signed it, such as Let’s Encrypt, Sectigo or DigiCert, and the name of the intermediate it used.
Chain: Whether the certificates the server sends lead to a root certificate that browsers trust. “Missing intermediate” means the server sends its own certificate but not the one that links it to the root.
Hostname: Whether the domain you entered is one of the names on the certificate, directly or through a wildcard like *.example.com.
Protocol: The TLS version the server agreed to. TLS 1.2 and 1.3 are current; 1.0 and 1.1 are retired and flagged.
Names: Every hostname the certificate covers (its subject alternative names). One certificate often covers both example.com and www.example.com.
Fingerprint and serial: Identifiers for this exact certificate. Compare them with what your CA issued to confirm the server picked up a renewal.
Domain (RDAP): When the domain registration itself expires, from the registry. A valid certificate on a lapsed domain helps nobody.

Check certificate expiry from the command line

On any machine with OpenSSL, this prints the expiry date (notAfter) of the certificate a server sends:

Terminal

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -enddate

The -servername flag matters: servers that host several sites pick the certificate by that name. More ways, including curl and the browser, are in how to check SSL certificate expiry.

When a certificate is close to expiry

Find out how it renews. Most certificates renew automatically: certbot or acme.sh on a timer, a web server such as Caddy, or your host or CDN. Some are still bought and installed by hand.
If it’s automatic, run the renewal yourself and read the output. With certbot, certbot renew --dry-run shows whether it would succeed. Common failures: DNS moved, port 80 blocked for the HTTP challenge, or expired API credentials for the DNS challenge.
Make sure the server uses the new certificate. Reload the web server after renewing, and check every machine behind a load balancer and the CDN, not just one.
Check again here. The new expiry date and fingerprint should show.
Set up alerts so the next expiry doesn’t depend on someone remembering. That is what Expiry Watch is for.

Why expiry dates matter more now

Public TLS certificates are getting shorter. Since March 15, 2026, they can last at most 200 days; from March 15, 2027, 100 days; and from March 15, 2029, 47 days. Each step means more renewals, and more chances for one to fail quietly. Details are in 47-day SSL certificates: timeline and prep.

Let’s Encrypt also stopped sending expiry reminder emails on June 4, 2025, so a broken renewal no longer produces a warning in your inbox unless you set one up.

How the check works

We resolve the domain, connect to port 443 from our checker, and complete a TLS handshake using the domain name, the way a browser would. We read the certificates the server sends, then disconnect. We don’t load the page, send any data or follow redirects.

The result describes that one connection. Sites with several servers, or a CDN with regional edges, can serve different certificates in different places.

Questions

Short answers about this check.

Is the SSL checker free?

Yes. Check as many domains as you like, with no account. Monitoring with email alerts is free for up to 3 domains.

Does a valid result mean my site is secure?

No. The check reads the certificate and its chain: dates, issuer, trust and names. It doesn’t scan for vulnerabilities or judge your server’s configuration beyond the TLS version it agreed to use.

My browser shows the padlock, but the checker says the chain is incomplete. Who is right?

Both. Chrome fetches a missing intermediate certificate by itself, and Firefox ships a list of known intermediates, so they cover for the server.

Most other clients don’t: curl, scripts, payment and webhook senders, many apps and monitoring tools. They fail until the server sends the full chain.

Which certificates count as trusted?

Our checker uses the root certificates bundled with Node.js, which come from Mozilla’s root store, the same list Firefox and many Linux systems use. A private or company root is reported as untrusted.

Why does it say “check unavailable” or “check failed”?

Unavailable means our checker didn’t answer in time; the registration details still show. Failed means we couldn’t complete a TLS connection: no DNS record, nothing listening on port 443, a firewall, or a server that doesn’t speak TLS.

Neither is a verdict on the certificate. We never show a failed check as expired.

Can I check an IP address, a non-standard port or an internal site?

No. The checker connects only to public domain names on port 443, and refuses addresses in private, internal or reserved ranges.

Do you keep the domains I check?

We don’t keep a history of your checks or tie them to you. Registry answers are reused for up to 12 hours so repeat lookups are quick, then deleted within a week, and like any web service our request logs are kept for a few days.

Get an email before it expires

Expiry Watch checks the domain every day and emails you 30, 14, 7, 3 and 1 day before the certificate or the registration expires. Free for up to 3 domains.