Check a website's live SSL certificate: expiry, names, issuer, chain and TLS version
Checked from our server in India. Only the address you type is sent to us; nothing else leaves your device. Updated on 18 Oct 2026.An SSL checker reads the certificate a server presents and tests it the way a browser does. This one connects from our server in India to port 443 or another port and reports the expiry date and days left, the names covered, the issuer, the full chain and the TLS version, flagging expired, self-signed or mismatched certificates.
Type the domain, and change the port if the service is not on 443.
Press Check SSL. Our server opens one TLS connection and reads the certificate.
Read the verdicts and the certificate details, then copy the report.
The SSL Checker connects to a live server the way a browser does: it opens a TLS connection to port 443, or the port you choose, sends the domain as the server name (SNI), and reads the certificate and chain the server returns. Then it checks four things. Is the certificate within its dates, and how many days are left? Does the chain lead to a root that browsers trust, using the same Mozilla root list? Does the certificate name the domain you typed? And which TLS version and cipher did the server agree to?
Each problem is said in words. An expired certificate shows how many days ago it ran out. A self-signed certificate is flagged because no browser will trust it. A missing intermediate certificate, the most common cause of "works in Chrome, fails on Android or in curl", is named as such. A certificate for the wrong name shows which names it does cover. Fewer than 30 days left is a warning, fewer than 8 a failure.
Below the verdicts are the details: subject, every name in the Subject Alternative Name list, issuer, valid-from and valid-until dates, key type and size, serial number and SHA-256 fingerprint, and the chain in the order the server sent it. The certificate can be copied as PEM and opened in the Certificate Decoder for every field.
Revocation is not checked: OCSP and CRL lookups are left out. The checker reports the TLS version the server chose with a modern client, not every version it accepts. It works on any TLS service, so port 993 for IMAP or 465 for SMTP is fine, but not on STARTTLS services; for mail on port 25 use the SMTP Test.
The check is made from our server in India; a site using several servers in different regions can present a different certificate elsewhere.
Type the domain and press Check SSL. The first line gives the expiry date and the number of days left, read from the certificate the server presents right now. Under 30 days is flagged as a warning and under 8 as a failure, so a renewal that has stopped working is caught early.
The usual cause is a missing intermediate certificate. Desktop Chrome can fetch the missing link itself, but Android apps, curl and many servers cannot. The checker reports a server that sends only its own certificate, or a chain that cannot be completed, so the web server configuration can be fixed.
A self-signed certificate is signed by its own key instead of by a public certificate authority. Nothing vouches for it, so every browser shows a warning. Such certificates are fine for testing or internal tools, but a public website needs one from an authority such as Let's Encrypt.
Yes. Type the port in the Port box, or add it to the host as example.com:8443. Any service that starts TLS immediately works, such as IMAP on 993, POP3 on 995 or SMTP on 465. Services that upgrade with STARTTLS, such as mail on port 25, need the SMTP Test instead.
No. OCSP and CRL lookups are not made, so a certificate revoked by its authority can still show as valid here. Revocation is rare for ordinary websites, and browsers handle it in different ways, which is why the page states the limit rather than guessing.
TLS 1.3 is the current version and the fastest to connect; TLS 1.2 is still fine. TLS 1.0 and 1.1 were dropped by every major browser in 2020, so a server that still agrees to them is flagged. The checker reports the version the server chose for our connection.
Still stuck? Ask about SSL Checker and anybody who knows can answer. No account needed.
Also works as: SSL Certificate Checker · SSL Expiry Checker.
Same job, other tools: Domain Expiry Checker – Domain expiry check: the registry’s own expiry date, with the days left counted · CAA Record Lookup – See which certificate authorities a domain allows to issue its SSL certificates · TXT Record Lookup – Read the TXT records of a domain: SPF, site verification codes and other text.