SSL Certificate Checker — expiry, issuer and coverage
Connect to any site over TLS and read its certificate: who issued it, when it expires and which hostnames it covers.
Free and instant — results appear in seconds. No sign-up, no limits, and nothing you type is stored.
An expired certificate is one of the few failures that stops a website dead. Browsers do not warn gently — they interpose a full-page interstitial that most visitors will not click through, and they are right to. From the browser's point of view an expired certificate is indistinguishable from an attack.
This tool opens a real TLS connection to port 443 and reads the certificate the server presents, which is exactly what a browser does. It reports the expiry date, the issuing authority, the signature algorithm and every hostname listed in the certificate.
That last part catches the most common mistake: a certificate issued for example.com that does not include www.example.com, so half your visitors see a warning and the other half do not.
What the coverage list tells you
A healthy result on a site using automated renewal looks like:
68 days remaining — expires 12 October 2025Issued to: example.com
Issued by: Let's Encrypt
Valid from: 14 July 2025
Valid to: 12 October 2025
Signature: RSA-SHA256
Covers: 2 hostnames → example.com, www.example.com
```
The 90-day lifetime is normal for Let's Encrypt and deliberately short — the assumption is that renewal is automated, and a short window limits the damage if a key leaks. Seeing 68 days left means renewal ran and worked.
The coverage list is the field worth checking carefully. Two hostnames here, and both forms of the domain are present. Had it listed only example.com, anyone reaching www.example.com would get a certificate-name-mismatch warning — technically a valid certificate, presented for the wrong name.
A wildcard certificate shows as .example.com. Note that a wildcard covers one level only: .example.com secures blog.example.com but not api.v2.example.com, and it does not cover the bare example.com unless that name is listed separately.
Under 30 days on a certificate that should be auto-renewing means the renewal job has stopped. That is the moment to check it, not the week it expires.
What HTTPS actually guarantees
A valid certificate proves that the connection is encrypted and that the server presenting it controls the domain name in the address bar. That is the whole claim.
It says nothing about whether the operator is honest, whether the site is safe, or whether the business behind it exists. Domain-validated certificates are free and issued in seconds to anyone who can prove control of the name — including people running phishing sites. The padlock means the connection is private, not that the destination is trustworthy.
Certificate types
Domain Validated (DV) — proves control of the domain. Issued in seconds, usually free. Sufficient for the overwhelming majority of sites.
Organisation Validated (OV) — the CA additionally verifies the organisation exists. The details sit inside the certificate where nobody looks.
Extended Validation (EV) — stricter vetting. Browsers removed the distinctive green address bar years ago, so the visible benefit is now essentially nil.
Since browsers stopped displaying the difference, the practical security gap between DV and EV for a normal website is not worth the price difference.
Why renewals fail
Automated renewal is reliable until something quietly changes underneath it:
- The HTTP-01 challenge is blocked. A redirect rule that forces every request to HTTPS, or a firewall rule, can prevent the CA reaching
/.well-known/acme-challenge/. Exclude that path from redirects. - The cron job is gone. Server rebuilt, control panel migrated, timer disabled. The renewal simply stops running and nothing alerts you.
- DNS moved. The CA validates against current DNS. If the domain now points elsewhere, validation fails.
- A CAA record blocks the CA. Adding a CAA record for one authority and later switching to another causes refusal at issuance.
- The certificate renewed but was not installed. Common on manual setups: a new file on disk, but the web server never reloaded and is still serving the old one.
That last case is why checking from outside matters. The file on the server and the certificate actually being served are different things.
Certificate lifetimes are shortening
Maximum certificate validity has fallen repeatedly — from years, to 825 days, to 398 days, with the industry moving toward substantially shorter periods still. The direction is settled: manual certificate management is being deprecated by policy. If you are still renewing by hand, automating it now avoids a forced migration later.
Frequently asked questions
How long before expiry should I renew?
Automated systems typically renew at 30 days remaining, which leaves a comfortable margin for retries if a renewal attempt fails. If you are renewing manually, treat 30 days as the deadline rather than the target — and set a calendar reminder independent of any email notification.
My certificate is valid but the browser still warns. Why?
The usual cause is a name mismatch — the certificate does not list the exact hostname being visited, most often missing the www form. Check the coverage list in the result. Mixed content, where an HTTPS page loads resources over plain HTTP, produces a different and less severe warning.
Does a wildcard certificate cover the main domain?
Not automatically. A certificate for *.example.com covers one level of subdomain, so blog.example.com is included but example.com itself is not unless listed separately. Most wildcard certificates do include the bare domain as an additional name, but it is worth confirming rather than assuming.
Is a paid certificate more secure than a free one?
The encryption is identical. Paid certificates may add organisation validation, warranties and support, but the cryptographic protection is the same. For a standard website, a free automatically-renewing certificate is the better operational choice because it removes the human step that causes most outages.
Why does my certificate only last 90 days?
Short lifetimes are deliberate. They limit the window during which a compromised key is useful and force renewal to be automated rather than a manual annual task. Industry maximum validity has been falling steadily, so short-lived certificates are becoming the norm rather than the exception.
What is a CAA record and do I need one?
A CAA record in DNS lists which certificate authorities may issue certificates for your domain, so a CA receiving a request from anyone else is obliged to refuse. It is a worthwhile addition, but remember to update it if you change authorities — a stale CAA record will block your new provider.
Reviews
No reviews yet. If this tool solved something for you, yours would be the first — and it helps other people decide whether it is worth their time.