Technical
SSL Certificate Checker
Check a certificate before it expires on you
Enter a hostname and get the certificate it serves: the names it covers, who issued it, the days left before it expires, whether the chain to a trusted root is complete, and the protocol versions the server agreed to.
Get early accessWhat it returns
- The subject, every name in the subject alternative name list, the issuer, and the valid-from and valid-to dates with the days remaining.
- Whether the chain the server presented reaches a trusted root, and which intermediate certificate is missing when it does not.
- The names that do not match: a certificate valid for the bare domain but not the www host, or a wildcard that does not cover a second-level subdomain.
- What the connection negotiated, including TLS version and cipher suite, and whether older protocol versions are still accepted by the server.
When this matters
A certificate renews itself for two years and then the renewal fails quietly on a subdomain nobody opens in a browser, which happens to be the host serving images. Half the images on the site stop loading in Chrome and keep loading in every tool that ignores certificate errors, so the bug report says the site looks broken on some machines. The other common version is a certificate that is entirely valid while the server forgets to send the intermediate: it works on desktops that already cached that intermediate and fails on a phone that did not.
How to answer this today
Site audit crawls over HTTPS, and the full rule set covers what a certificate problem produces on the site itself: mixed content, internal links still pointing at insecure URLs, and HTTPS pages that fail to load at all, each tied to the pages where they appear. Looking up the certificate on one host, including a subdomain that is not part of the crawl, is the check this tool handles.
Site auditWhy this is harder than it looks
Expiry is one failure out of several
A certificate can sit comfortably inside its dates and still be rejected for a name mismatch, a missing intermediate, a revoked status or a signature algorithm clients no longer trust. Reporting only the days remaining calls a broken certificate healthy, which is the most expensive way to be wrong here.
The chain the server sends is the chain that matters
Clients differ in how much they will repair an incomplete chain from intermediates they already hold, so the same server works in one browser and fails in another. What the server actually presents during the handshake is the honest thing to report, even when a desktop browser papers over it.
One hostname, one port, one moment
A server can present different certificates depending on the name requested, and a load balancer can answer for many hosts on one address. A result belongs to the exact name and port that were checked, at the time they were checked, and says so.
Rate limits
Each check is a full TLS handshake against a host the visitor names. The per-visitor limit is what keeps that from being pointed at a third party over and over, which is the line between a lookup and a scan nobody consented to.