An SSL certificate checker that shows the days left and what is wrong
This SSL certificate checker connects to a website the way a browser does, reads the certificate chain the server sends and explains whether it is healthy: how many days until the certificate expires, whether it covers the host name you typed, whether the chain is complete and in order, which TLS version and cipher the server chose, and whether TLS 1.3 is on.
Check one domain for a full report, or up to 10 at once for an expiry dashboard you can save as CSV — handy for agencies and anyone who has been caught out by a certificate that silently expired. Certificates are decoded and their signatures verified in your browser, with the same parser as the SSL Certificate Decoder.
How to use the SSL Certificate Checker
- Type a domain such as
example.cominto “Domain or host name”. Change the port if the service is not on 443, or write it asexample.com:8443. - Press Check certificate. The result usually appears within a second or two.
- Read the big number — the days left — then the checks: name, chain, TLS version, cipher and revocation.
- Under Certificate chain as sent by the server, see who signed each certificate and whether the signature verifies; expand one for its names and fingerprint.
- For several sites choose Batch (up to 10), paste one domain per line and press Check all. The most urgent rows come first; Download CSV keeps a record.
SSL Certificate Checker features
Days until expiry, front and centre
Green, amber (30 days or fewer) or red (7 days or fewer, or expired), with the exact expiry time in UTC.
Host name match
Your host is compared with every Subject Alternative Name, including one-label wildcards and IP addresses — the rule browsers use.
Chain completeness and order
Finds a missing intermediate, a wrong order, extra certificates or an unnecessary root, verifies each signature with Web Crypto and warns when an intermediate expires first.
TLS version and cipher
Shows the suite the server picked from a modern TLS 1.2 offer, flags CBC and non-forward-secret choices, and tests separately for TLS 1.3.
Batch expiry dashboard
Up to 10 domains, sorted by urgency, with a CSV of days left, expiry date, issuer, name match, chain and TLS details.
What each result means
| Check | Healthy result | If it fails |
|---|---|---|
| Days left | More than 30 days | Renew, and fix automatic renewal |
| Name match | Your host is in the SAN list | Reissue with every name you use (www and non-www) |
| Chain | Your certificate first, then each intermediate | Install the full chain (fullchain.pem) |
| TLS version | TLS 1.3 available, TLS 1.2 accepted | Disable TLS 1.0/1.1, enable TLS 1.3 |
| Cipher | ECDHE with AES-GCM or ChaCha20 | List forward-secret AEAD suites first |
| OCSP stapling | A fresh “good” response | Optional — many CAs publish revocation lists instead |
Worked example: github.com
A check of github.com on 13 October 2026 (UTC) returned three certificates: the leaf for github.com and www.github.com with an EC P-256 key, issued by Sectigo Public Server Authentication CA DV E36, then that intermediate, then Sectigo’s E46 root cross-signed by USERTrust ECC. The leaf runs from 1 September to 29 November 2026, 23:59 UTC — a 90-day certificate with 47 days left, so the result was green. A host such as gist.github.com would not match: it is not in the SAN list.
The server picked TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 for TLS 1.2 and answered the TLS 1.3 test. It staples no OCSP response, so the revocation line lists Sectigo’s OCSP responder from the certificate.
Revocation, TLS 1.3-only servers and other limits
A certificate can be revoked before it expires, for example after its key leaks. This checker does not ask the certificate authority. If the server staples an OCSP response — a short, CA-signed “still good” note — the tool shows its status and dates without verifying its signature; otherwise it lists the revocation addresses in the certificate. Many authorities, Let’s Encrypt included, have replaced OCSP with revocation lists, which browsers download in the background.
To read the certificate, the tool offers only TLS 1.2, where the certificate travels unencrypted. TLS 1.3 encrypts it, and this tool never completes or decrypts a handshake, so a server that accepts only TLS 1.3 is reported as “TLS 1.3 only” — a modern, valid setup — without certificate details.
The check runs on Cloudflare’s network, not your device. Sites served through Cloudflare itself cannot be checked, because Cloudflare blocks raw connections to its own addresses. Only public hosts work; port 25 and STARTTLS are not supported; each network may run 30 certificate or port checks per 10 minutes. The tool cannot know whether every device trusts the root CA. For reachability use the Port Checker; for HSTS and CSP, the Security Header Checker.
SSL Certificate Checker FAQ
How do I check when my SSL certificate expires?
Enter your domain in the SSL certificate checker and press Check certificate. The large number is the days left on the certificate your server is sending right now, with the exact expiry date and time in UTC underneath.
Why does my browser say the certificate is not valid for this name?
The certificate does not list the host you visited. Browsers compare the host only with the Subject Alternative Names; *.example.com covers www.example.com but neither example.com nor a.b.example.com. Reissue the certificate with every name you use.
What is an incomplete certificate chain?
Your server must send its own certificate plus the intermediates that link it to a trusted root. If it sends only its own, some browsers fetch the missing piece, but apps and tools such as curl fail. Install the “full chain” file from your certificate authority.
Why does it say “TLS 1.3 only” instead of showing the certificate?
TLS 1.3 encrypts the certificate, and this tool reads it from an unencrypted TLS 1.2 handshake only. Use your browser’s padlock, or openssl s_client and the decoder, to read it.
Can I check mail servers or other ports?
Yes — any port except 25, if the service starts with a TLS handshake: 465, 993, 995, 8443 and so on. STARTTLS services such as port 587 are not supported.
Is it safe to check my site here?
Yes. Certificates are public — every visitor receives them. Only the domain and port are sent; the checker sends no cookies and downloads no page.
How often should I check SSL expiry?
Automated certificates renew about 30 days before expiry, so weekly is plenty; under 30 days left means renewal failed. CA/Browser Forum rules cap new certificates at 200 days from March 2026, 100 from March 2027 and 47 from March 2029.