SSL certificate checker

Use this SSL certificate checker to inspect a live certificate and its chain. Review TLS support and HTTPS policy, then save an expiry reminder.

Free, no account. Ten technical checks per hour, shared across these tools.

Use the exact hostname. Port 443 is the default; :80 is also allowed. Paths are ignored. Checks stop after 12 seconds and can be cached for five minutes.

An SSL certificate checker reads the certificate a website serves and tests whether it matches the hostname, is current and reaches a trusted root. This free checker also probes TLS versions, selected cipher families, HSTS and CAA. Each finding includes a fix. Incomplete checks are labelled and receive no overall grade.

How to use this checker

Check the live connection
Enter an exact public hostname, including www if visitors use it. Port 443 is the default. Only ports 80 and 443 are allowed under our safe port policy. Paths are ignored. The run stops after 12 seconds and checks one public IP.
Inspect the certificate and served chain
Dates, names, keys, signatures and trust use the live TLS connection and Node roots. A separate TLS 1.2 exchange reads served certificate order. When that is unavailable or serves a different leaf, the Node path is labelled and served order remains unverified.
Read the grade and its deductions
The report publishes every deduction from 100, the grade thresholds and fixes. Failed graded probes withhold the grade. Only offered cipher families are checked; unavailable local families are excluded. This is an AIGROW configuration grade, separate from SSL Labs.
Review HTTPS policy and plan renewal
A verified HTTPS HEAD reads HSTS without following redirects or reading page content. CAA is checked at the exact hostname. Optional preload and crt.sh lookups are time-boxed. Download a calendar file with the exact expiry time and a reminder 14 days earlier.

Questions about this checker

Yes, when a TLS handshake completes. Certificate inspection permits invalid certificates so their dates and names can be reported, while trust is evaluated separately. The HSTS request requires a trusted HTTPS connection.

No. It describes only our published configuration checks. We do not validate revocation, test vulnerabilities, enumerate every cipher or inspect an origin behind a CDN. A timeout remains unverified. Use SSL Labs for a longer scan.

A CDN can terminate TLS before your origin. Servers can select different certificates for different clients, protocols or locations. We check one public IP with Node roots. Browser trust stores and policies may differ.

No. crt.sh shows logged issuance, which may include old or unused certificates. We keep it separate from the live certificate. If the optional endpoint times out or exceeds its response limit, the live check still works.

No. The .ics file is created on your device and contains the observed expiry time plus a reminder 14 days before it. It does not update when your certificate renews. Confirm that your host has working automatic renewal.

Related tools

  • Website down checker

    The website down checker measures availability from our server, with DNS, connection, TLS and first byte timings per hop. Compare DNS answers and repeat after one minute.

  • HTTP header checker

    Inspect every redirect with the HTTP header checker. Review security grades and cookie flags, then compare browser and crawler responses.

  • Redirect checker

    Use this redirect checker to inspect HTTP chains for up to 100 URLs. Compare crawler and browser responses, then review loops and canonical conflicts.

Check your business in AI answers

Technical checks help you repair a page. The free AI visibility scan shows the answers checked for your business and what to work on next.

Run the free AI visibility scan