Free tool
SSL / TLS certificate checker
Issuer, SAN, expiry date, and days remaining.
The SSL/TLS certificate checker opens a live TLS connection to the hostname you enter and reports issuer, subject alternative names, validity window, and days remaining — useful before renewals fail in production.
What we inspect
We connect to the host on the standard HTTPS port and read the leaf certificate presented by the server. You will see who issued it, which names it covers, and when it expires. This is a direct check, not a third-party certificate-transparency API.
Common failure modes
Expired certificates trigger browser warnings immediately. Hostname mismatch (wrong SAN) fails even if the cert is still in date. Incomplete chains often break mobile clients while desktop browsers quietly fetch intermediates.
- Confirm SAN includes exact hostname users type
- Monitor days remaining — 90-day certs need automation
- After renewal, re-check www and apex separately if both are used
After the cert is healthy
Use the HTTP header checker to verify HSTS and other security headers. DNS CAA can also block issuance — inspect CAA via DNS lookup if ACME suddenly fails.
FAQ
Deeper guide: Read: SSL expiry checklist