SSL certificate checker.
Open a live TLS connection, verify the chain and hostname, identify the issuer, and count the days to expiry. Use it before a client launch or when auto-renewal stops quietly.
A real handshake, not a cached scan.
The checker opens a live TLS connection to the domain on port 443 and inspects the certificate the server actually presents — the same one your visitors' browsers see.
HTTPS reachability
We complete a full TLS handshake with SNI, exactly like a browser. If no secure connection can be established at all, that's the first thing you'll see.
chain of trust
The certificate is verified against trusted root authorities. Self-signed certificates, untrusted issuers, and broken chains all surface as verification failures.
hostname match
A certificate only counts if it covers the name you typed. A cert issued for www that doesn't cover the apex domain (or vice versa) fails verification.
expiry date
The certificate's exact validity window and the number of days remaining, so “is it about to expire?” gets a precise answer instead of a guess.
renewal-aware warnings
We warn when less than a quarter of the certificate's lifetime remains, capped at 30 days — so a healthy 90-day Let's Encrypt renewal cycle stays quiet, but a broken one doesn't.
issuer
Who issued the certificate that's actually being served — useful for spotting an unexpected CA or confirming a migration actually took effect.
The SSL mistakes we see most.
broken auto-renewal
Certificates rarely expire because someone forgot a date — they expire because an automated renewal silently stopped working weeks earlier. Nobody notices until browsers start throwing full-page warnings.
missing intermediate certificate
The server sends only the leaf certificate and relies on browsers to fill in the chain. Many clients can't, so the site works on your laptop and fails for API clients, older devices, and strict validators.
hostname mismatch
The certificate covers www.example.com but visitors hit example.com, or a subdomain got pointed at a server whose cert doesn't include it. The cert is perfectly valid — just not for that name.
self-signed certificates in production
Fine for local development, a full-page browser warning for everyone else. They also train users to click through security warnings, which is its own problem.
no HTTPS at all
Port 443 closed or timing out. Browsers now mark plain-HTTP sites as “Not secure”, and any HSTS or redirect setup upstream will strand visitors on an error page.
SSL questions, answered.
It connects to a domain over HTTPS and inspects the SSL/TLS certificate the server presents: whether the certificate chain is trusted, whether it covers the domain name, who issued it, and when it expires. It answers the question “will visitors see a security warning?” before your visitors do.
Browsers show a full-page security warning and block the site until the user clicks through, most users leave, and API clients fail outright with certificate errors. Email, webhooks, and integrations that connect to the domain over TLS break at the same moment.
Publicly trusted certificates are currently capped at about 200 days, and the maximum is scheduled to keep shrinking over the next few years. In practice most sites use 90-day certificates from CAs like Let's Encrypt with automated renewal — which makes a working renewal setup, not the expiry date itself, the thing worth watching.
The most common cause is a missing intermediate certificate. Browsers cache intermediates or fetch them on the fly, so the site looks fine in Chrome while stricter clients — curl, mobile apps, monitoring agents, older devices — fail to build the chain. Your browser is being forgiving; the checker is telling you what everyone else sees.
Yes. The handshake verifies the certificate against trusted root authorities, so an untrusted issuer, a self-signed certificate, or a chain the server fails to present correctly all show up as verification failures with the underlying reason.
With automated renewal, certificates typically renew when about a third of their lifetime remains — Let's Encrypt renews its 90-day certificates at 30 days out. If you're renewing manually, don't cut it close: renew at least two weeks early so DNS, deployment, and propagation issues have room to go wrong without taking the site down.
A valid certificate is one part of the client domain.
The free scan checks SSL & domain expiry, email auth & DMARC, look-alikes, and blacklists together from public records. One result, no signup.
Keep checking the same failure point.
Use the related tools one at a time, or run all four posture checks together.