SSL certificate checker

Read what a host's TLS certificate actually says: how many days it has left, who issued it, which names it covers, and whether the server is sending the full chain. Certificates do not fail slowly. They work, and then at a known second they stop.

one handshake from our probe · public hosts only · nothing stored

Enter a hostname to read its certificate.

What the check reads

For HTTPS redirects and security headers alongside certificate results, run the website security checker.

field	what it tells you
days left	Time until the certificate stops being accepted. Below thirty, a renewal has already failed at least once.
issued by	The authority that signed it. A change here you did not make is worth reading twice.
covers	The names on the certificate. A name that is missing is rejected by every client, however valid the dates.
chain	How many certificates the server sent. One is the classic misconfiguration: the intermediate is missing and strict clients fail while browsers hide it. How the certificate chain works explains the fix.
self-signed	Subject and issuer are the same name. Fine inside a network, fatal on a public endpoint.

Why expiry still takes people down

Automated renewal did not remove the outage, it moved it. A certificate renews every sixty days without anyone watching, which means nobody is watching on the day the renewal breaks: a DNS challenge that no longer resolves, a firewall rule that blocks the HTTP challenge, an account that hit a rate limit, a cron job on a host that was rebuilt without it. The certificate stays valid for another thirty days after that, and every one of those days looks exactly like success.

The other half is that a certificate is not one thing. The homepage renews, and the API on a different host, the mail server, or the internal load balancer terminating TLS behind the CDN does not. Checking by hand finds the one you remembered to check.

A certificate that expired at midnight is how the mystery of the "down" website ends, and do I need an uptime monitor covers the other failures a homepage check never sees.

For the setup walkthrough, see how to monitor SSL certificate expiry: check the certificate your server presents, choose warning thresholds, and test that the alert reaches you.

FAQ

How many days before expiry should I renew?

Thirty days is the usual alarm and fourteen the usual panic. Let's Encrypt certificates last ninety days and renew at sixty, so a certificate sitting below thirty means the renewal has already failed at least once and nobody read the mail about it.

The certificate is valid but my browser still complains. Why?

Almost always an incomplete chain. The server is sending its own certificate without the intermediate that links it to a trusted root. Desktop browsers often paper over it from cache, while a fresh client, a mobile app or a server-to-server call fails outright. The chain length reported here is what the server actually sent.

What does the hostname match mean?

A certificate is issued for a set of names. If the name you asked for is not among them, every client rejects it no matter how valid the dates are. This is the usual failure after a domain is added to a load balancer but not to the certificate.

Do you check the whole chain against a trust store?

No, and deliberately. Validation is skipped so an expired or self-signed certificate can still be read and reported instead of the handshake refusing it and losing the dates. That is the case you most need to see.

Can I be told before it expires instead?

Yes. A TLS certificate check reads the same certificate on a schedule and alerts at the day count you choose, which is the point: an expiry is the one outage you can know about weeks ahead. The button beside the result opens a monitor prefilled with the host you just checked.

Be told at thirty days, not at zero

A TLS certificate check reads the same certificate on a schedule and alerts at the day count you pick, from every region you enable.

start free

more free tools: uptime SLA calculator · cron expression generator · error budget calculator · incident message generator · DNS lookup · HTTP header checker · domain expiry checker · website security checker · the whole set