Processed on our server. Your input is sent to our server to produce the result. Uploaded files are not kept, and nothing is sold or shared; our privacy policy lists what is logged.
Check Any Website’s SSL Certificate Online
The Tools Kit’s free SSL Certificate Checker connects to a domain the way a browser does and reports what it finds: whether the certificate is valid and trusted, who issued it, when it starts and expires, how many days are left, which hostnames it covers, and the TLS protocol version and cipher suite the connection used. If validation fails, you see the exact error code rather than a vague warning.
The check runs from our server, not your browser, so the result reflects what a fresh client on the public internet sees, without anything your own browser has cached. It always tests port 443, the standard HTTPS port, and it only checks public hosts.
How to Check an SSL Certificate
- 1
Enter the domain
Type the domain or subdomain you want to test, such as example.com or shop.example.com. A pasted URL is fine: https://, any path and any port number are stripped before the check.
- 2
Click Check Certificate
Press the button or hit Enter. Our server opens a TLS connection to the domain on port 443 and reads the certificate it presents, giving up after 8 seconds if there is no answer.
- 3
Read the trust banner
A green banner means the certificate is valid and trusted and shows how many days remain until it expires. An amber banner shows the exact validation error, such as CERT_HAS_EXPIRED.
- 4
Review the details
Check the subject, issuer, Valid From and Valid To dates, negotiated protocol and cipher, and the Subject Alternative Names to confirm every hostname you need is covered.
If the domain will not resolve at all, look up its records first with the DNS lookup tool; a missing or wrong A or AAAA record is a common reason a new site has no working certificate yet.
What the Results Mean
| Field | What it tells you |
|---|---|
| Subject (CN) | The common name on the certificate, for example example.com or *.example.com |
| Issuer | The certificate authority or intermediate that signed it (its common name, or its organization if there is none) |
| Valid From / Valid To | The validity window, in GMT; the certificate is rejected before the first date and after the second |
| Protocol | The TLS version negotiated for this check, such as TLSv1.3 or TLSv1.2 |
| Cipher | The cipher suite used for the connection, such as TLS_AES_256_GCM_SHA384 |
| Subject Alternative Names | The hostnames the certificate is valid for, each shown with a DNS: prefix (first 20 listed) |
The days-remaining figure in the green banner is the time between now and the Valid To date, rounded to the nearest whole day. A certificate valid to 25 December at 22:56 GMT, checked on 2 October at noon GMT, would show 84 days (about 84.46 days, rounded). Publicly trusted certificates are short-lived, often just 90 days, so a certificate with under 30 days left should already be in its renewal window.
To dig deeper into a certificate file you have on disk rather than one served by a website, paste it into the certificate and CSR decoder, which also reads certificate signing requests before you send them to a CA.
Common SSL Errors and How to Fix Them
When a certificate fails validation, the amber banner shows the error code returned by the TLS library. These are the ones you are most likely to see:
- CERT_HAS_EXPIRED: the Valid To date has passed. Renew the certificate, install it, and reload the web server.
- ERR_TLS_CERT_ALTNAME_INVALID: the certificate does not cover the hostname you checked. Compare the hostname with the Subject Alternative Names; a certificate for example.com does not cover www.example.com unless that name, or *.example.com, is listed.
- UNABLE_TO_VERIFY_LEAF_SIGNATURE: the server is sending its own certificate without the intermediate that links it to a trusted root. Configure the full chain file your CA provided.
- DEPTH_ZERO_SELF_SIGNED_CERT: the certificate is self-signed, so no public client will trust it. Replace it with one from a public CA.
- SELF_SIGNED_CERT_IN_CHAIN: the chain ends in a root that is not publicly trusted, typical of private or corporate CAs.
The missing-intermediate case is easy to overlook because some desktop browsers repair it silently, while apps, payment webhooks and scripts fail. When one of those clients reports an HTTP error instead of a TLS one, the HTTP status codes reference explains what each code means and how to fix it.
SSL vs TLS: What Is Actually Being Checked
SSL was replaced by TLS long ago, and SSL 3.0 and TLS 1.0 and 1.1 are all deprecated. The name stuck, so an “SSL certificate” today is an X.509 certificate used with TLS. This checker negotiates TLS 1.2 or TLS 1.3; a server that only offers older versions will fail to connect, which is itself a sign it needs updating.
A valid certificate is only part of a secure HTTPS setup. Once the certificate checks out, run the site through the security headers checker to confirm it sends HSTS, which tells browsers to always use HTTPS, along with other protective headers. To see whether HTTPS on 443 is the only service the host exposes, the port scanner gives a quick look at common ports.
Common uses
- Checking how many days remain before a certificate expires
- Confirming a renewed or newly issued certificate is installed and trusted
- Verifying a new subdomain is covered by a wildcard or multi-domain certificate
- Diagnosing “not secure” or chain errors reported by browsers, apps or API clients
- Seeing which certificate authority issued a competitor’s or vendor’s certificate
- Confirming a server negotiates TLS 1.2 or 1.3
Certificate expiry and domain expiry are separate deadlines, and either one can take a site offline. Check the registration renewal date with the WHOIS lookup, and if the domain sends email, make sure its SPF and DMARC records are in order with the DMARC and SPF checker. For more network and encoding utilities, browse all security tools.
SSL certificate terms explained
| Term | What it means |
|---|---|
| SSL / TLS | TLS is the protocol that encrypts HTTPS traffic; SSL is its retired predecessor, but the certificates are still widely called SSL certificates |
| Subject (CN) | The common name the certificate was issued to; modern clients match hostnames against the SANs instead |
| Subject Alternative Name (SAN) | The list of hostnames a certificate is valid for, including wildcards such as *.example.com |
| Issuer | The certificate authority (or intermediate) that signed the certificate |
| Intermediate certificate | A CA certificate that links your certificate to a trusted root; the server must send it along with its own certificate |
| SNI | Server Name Indication: the hostname sent at the start of the handshake so a server hosting many sites returns the right certificate |
| Cipher suite | The set of algorithms the two sides agree on for key exchange, encryption and integrity, such as TLS_AES_256_GCM_SHA384 |
Frequently Asked Questions
Enter the domain and click Check Certificate. The tool connects on port 443, validates the certificate chain against a standard set of trusted root authorities and checks that the certificate matches the hostname. A green banner means it is valid and trusted; an amber banner shows the specific reason it failed.
Run a check and read the Valid To field, which shows the expiry date and time in GMT. When the certificate is trusted, the banner also states how many days remain. An expired certificate is reported with the error CERT_HAS_EXPIRED instead.
The banner shows the validation error code. CERT_HAS_EXPIRED means the expiry date has passed, ERR_TLS_CERT_ALTNAME_INVALID means the certificate does not cover the hostname you entered, DEPTH_ZERO_SELF_SIGNED_CERT means it is self-signed, and UNABLE_TO_VERIFY_LEAF_SIGNATURE usually means the server is not sending its intermediate certificate.
Some browsers can fill in a missing intermediate certificate on their own, either from a cache or by downloading it. Many other clients, including command-line tools, API libraries and this checker, cannot, so they fail with UNABLE_TO_VERIFY_LEAF_SIGNATURE. Install the full chain (often called fullchain.pem) on the server to fix it for everyone.
No. The check always connects on port 443. If you type a port such as example.com:8443, the port is removed before connecting, so the result is for port 443.
Yes. The Subject Alternative Names panel lists the names on the certificate, each prefixed with DNS:, including wildcards like *.example.com. It shows the first 20 names, so very large multi-domain certificates may have more than are displayed.
They describe the connection our server negotiated with the site: the TLS version, such as TLSv1.3 or TLSv1.2, and the cipher suite used to encrypt it. They show the best option both sides agreed on, not every protocol or cipher the server supports.
The domain may not serve HTTPS on port 443, a firewall may be blocking the connection, or the server did not answer within 8 seconds. Servers that only support TLS 1.0 or 1.1 also fail, because the checker requires TLS 1.2 or newer.
No. The check runs from our server, so for security it refuses localhost, .local and .internal names, and any domain that resolves to a private, loopback or link-local address. Use a tool on your own network, such as openssl s_client, for internal hosts.
Results for each domain can be cached for up to 30 minutes, so a check run shortly after an earlier one may return the earlier result. Wait and check again, and also make sure the web server was reloaded after the new certificate was installed.
It is free with no sign-up. The check is a single standard TLS handshake, the same connection a browser makes when it opens your site, so it has no effect on the server.
Reviewed by Raja Jahangir · Last reviewed: October 7, 2026
How do you check an SSL certificate?
An SSL check reports the certificate's issuer, expiry date, covered hostnames, and whether the chain to a trusted root is complete. A missing intermediate certificate is the most common misconfiguration: it often works in browsers that cache the intermediate while failing in other clients.