SSL Certificate Checker
Queries a public record from our server — not your files.
See the certificate a host is actually serving, rather than the one you think you installed. It reports the expiry date, every name the certificate covers, the issuer, the key and whether the server sent its intermediate — the omission behind most "works in Chrome, fails on the phone" reports. Our server opens a TLS connection to the host you name and reads the certificate out of the handshake, because a browser is not allowed to show you this. Where that connection cannot be made, it reads the public Certificate Transparency logs instead and says so in the report. A public hostname goes out; nothing of yours does.
This tool is an exception on this site. Everything else here runs entirely in your browser, but a web page cannot query DNS, read a certificate or see another site’s response headers — so the name or URL you enter is sent to our server, which looks up the public record and sends the answer back. The answer is cached for up to a minute. No file of yours is read, uploaded or stored, and there is no account.
How to use SSL Certificate Checker
- 1
Enter the hostname to check — example.com, or www.example.com if that is the one serving the site.
- 2
Change the port only for a non-web service: 465 or 587 for mail, 636 for LDAPS.
- 3
Read the expiry, the names it covers, and the findings underneath.
Share
Embed this tool on your site
Paste this where you want the tool to appear. It runs entirely in your visitor's browser — no uploads, no account, no tracking.
Please keep the attribution line — it's what keeps these tools free.
Need a different size, a dark theme, or a different tool? Build an embed lets you preview it first.
Frequently asked questions
Does this send my data anywhere?+
It sends the hostname and port you type. Our server makes a TLS connection to that host, reads the certificate the host publishes to everyone who connects, and hangs up before the handshake completes. Nothing is uploaded from your device and no page content is fetched — the certificate is public by construction.
It says my certificate does not cover the hostname.+
A certificate is valid only for the names in its Subject Alternative Name list. The Common Name has been ignored by browsers since 2017, so a certificate with only a CN fails everywhere. Wildcards cover exactly one label: *.example.com is valid for www.example.com, and for neither example.com nor a.b.example.com — both of which are outages people have had while looking straight at a certificate that "should" work.
Why does it say the chain is incomplete when my browser is happy?+
Desktop browsers quietly fetch a missing intermediate certificate for themselves, using a URL inside the certificate. Phones, curl, Java clients and most API libraries do not. So a server that sends only its own certificate works in the browser you are testing with and fails everywhere else — which is exactly what "the API works from my laptop but not from the app" usually turns out to be.
Does this tell me the certificate is trusted?+
No, and it says so in its own output. It reports what the certificate claims and checks the two things that break sites — expiry and hostname coverage. Verifying the signature chain against a root store, and checking revocation, need a trust store and an extra round trip. A tool that half-did either would be worse than one that is clear about where the line is.
Why does it sometimes say the details came from Certificate Transparency?+
Because it could not open a direct connection. This service runs on Cloudflare, and Cloudflare does not permit one of its Workers to open a raw connection to a host that is itself behind Cloudflare — which is a large share of the web, and nothing to do with your configuration. Rather than report a failure, the tool falls back to the public logs every certificate authority must publish to, and labels the answer. That is what was issued for the domain, which is the same certificate you are serving in the ordinary case of an automated renewal, and not necessarily so if one was replaced without being logged.
It cannot read a host that works fine in my browser.+
The probe deliberately asks for TLS 1.2, because TLS 1.3 encrypts the server certificate and there is nothing to read. A host configured for TLS 1.3 only will refuse with a protocol_version alert, and the tool says exactly that before falling back to the logs. Rare, and a real fact about the host worth knowing.