SSL Certificate Checker
Inspect the SSL/TLS certificate for any domain — view issuer, expiry date, SANs, and days remaining.
Did this tool work for you?
How to use this calculator
- 1
Enter the domain name (without https://).
- 2
Click "Check Now" to connect to the server on port 443 and retrieve the SSL certificate.
- 3
Results show the issuer, validity period, days remaining, and Subject Alternative Names.
- 4
A certificate with fewer than 30 days remaining needs urgent renewal.
Frequently asked questions
How does the tool get the certificate?
Our server opens a TLS connection to port 443 of the hostname you enter, sends a HEAD request and reads the certificate the server presents. It connects with certificate validation switched off, so it can read certificates that browsers would reject. It reads the certificate only; it does not report the TLS protocol version, cipher suites or whether the server supports older protocols.
Does a result mean the certificate is trusted?
No. Because validation is off, the tool shows the certificate even when it is expired, self-signed, issued for a different name or missing an intermediate. It does not report a trust verdict, does not compare the hostname with the certificate names, and does not check revocation. Use the dates and the Common Name and SANs to judge these yourself, or check in a browser.
How are Days Remaining coloured?
Thirty or more days remaining shows as good, between 14 and 29 as a warning, and fewer than 14 as an error. A date in the past shows EXPIRED. The count is whole days between now and the notAfter date, rounded down. Automated issuers such as Let’s Encrypt issue 90-day certificates, so a warning in the last 30 days there suggests renewal is not running.
What are SANs and why do they matter more than the Common Name?
The Subject Alternative Name list holds the host names a certificate is valid for. Modern browsers match the host name against the SAN entries and ignore the Common Name. A wildcard such as *.example.com covers one label (www.example.com) but not example.com itself or a.b.example.com, so the apex normally appears as its own entry.
Why does the Common Name or Organisation show a dash?
The tool prints a dash when the field is absent. Certificates validated only for domain control carry no organisation, so Organisation is often empty, and some certificates leave the Common Name out entirely because the SAN list carries the names. Neither is a fault.
Does it check intermediate certificates or the full chain?
It reads the leaf certificate and shows who issued it, using the issuer’s organisation name or its Common Name. It does not list or validate the rest of the chain. A server that forgets to send its intermediate certificate may still appear fine here while failing for some clients.
Can it check ports other than 443, or a site behind a CDN?
It uses port 443 only. For a site behind a CDN, you see the certificate the CDN presents for that host name, not the certificate on your origin server. Enter a bare host name; a path or scheme is stripped to the hostname.
Can it check a certificate on an internal host or IP address?
Not on private or reserved addresses. The connection is opened from our server, which only contacts public hosts, so internal names, localhost and private IP ranges are refused. A public host name or public IP address works, on port 443.
TLS certificate details: what the SSL checker reports
What a TLS certificate states
An X.509 certificate used for HTTPS binds a public key to one or more host names and is signed by a certificate authority. When a browser connects, the server sends the certificate, and the browser checks that the signature chains to a trusted root, that the current date falls between the notBefore and notAfter values, and that the requested host name appears in the Subject Alternative Name list. This tool performs none of those trust decisions. It extracts the descriptive fields, shows how long the certificate has left, and leaves the judgement to you.
Fields in the result
Each line corresponds to a certificate field or a value computed from one.
| Label | Source | Colour rule |
|---|---|---|
| Common Name | Subject CN | None |
| Organisation | Subject O | None |
| Issued By | Issuer O, or CN if O is missing | Info |
| Valid From, Valid Until | notBefore and notAfter dates | Valid Until follows the expiry rule |
| Days Remaining | Whole days until notAfter | Green at 30 or more, amber 14 to 29, red under 14 or EXPIRED |
| SANs | DNS names in Subject Alternative Name | None |
| SHA-256 | Fingerprint of the certificate | None |
Example inputs and what to look for
Enter a bare host name such as example.com or www.example.com. Check both when your site answers on the apex and on www, since they can present different certificates or be covered by different SAN entries. In the result, first confirm that the host you typed appears in the SANs (or matches a wildcard), then check Valid Until and Days Remaining. A short interval before expiry on a certificate that should auto-renew points to a broken renewal job. If Issued By names a CDN or hosting provider rather than a public certificate authority you chose, the certificate you see belongs to that front end. Compare the SHA-256 fingerprint after a renewal to confirm that the new certificate is actually being served.
What this tool cannot tell you
Because the connection is made with validation off, a successful result is not proof that visitors will see a padlock. Missing intermediate certificates, a hostname mismatch, a revoked certificate or a protocol problem would all need a full TLS test or a browser check. Failures that stop the connection altogether, such as a closed port, a timeout after nine seconds or a server that does not speak TLS, appear as a single failed line with the error message. The date shown is converted using our server’s settings, so it may differ by a day from your local time near midnight.
Learn more from an authoritative source:
MDN Web DocsDomain Age Checker
Find out how old any domain is — see its registration date, age in years, and expiry date via RDAP.
WHOIS Lookup
Look up domain registration information — registrar, dates, nameservers, and status via the RDAP protocol.
HTTP Headers Checker
View all HTTP response headers for any URL and check for missing security headers like HSTS, CSP, and X-Frame-Options.
Redirect Checker
Trace the full redirect chain for any URL — see each hop, status code, and the final destination.
TTFB Checker
Measure Time to First Byte (TTFB) for any URL — see how fast your server responds and identify bottlenecks.
Website Page Size Checker
Check the HTML page size of any URL and get a resource breakdown — images, scripts, stylesheets, and inline assets.
Results are estimates for informational purposes only and do not constitute professional financial, medical, legal, or technical advice. Read full disclaimer →