How to use it
- 1Enter a domain such as
example.com, or paste a full URL – the hostname and port are taken from it. - 2Leave the port empty for HTTPS (443), or enter another one to check a mail server or other TLS service, such as 465 or 993.
- 3Click Check certificate. The verdict at the top tells you whether browsers will trust the connection and when the certificate expires.
- 4Scroll down for the certificate details, the domain names it covers, the full chain and the TLS version the server negotiated.
How SSL/TLS certificates and chains work
A certificate binds a domain name to a public key. When your browser opens https://example.com, the server sends its certificate and the browser checks three things: that a certificate authority (CA) it trusts issued it, that it covers exactly the name in the address bar, and that it hasn’t expired. SSL is the old name of the protocol – today’s connections use TLS, but the name “SSL certificate” stuck.
CAs don’t sign server certificates with their root keys directly. The root signs an intermediate certificate, and the intermediate signs yours. The server has to send its own certificate together with the intermediates – the chain – so the browser can link it to a root in its trust store. A missing intermediate is one of the most common installation mistakes: some browsers fetch the missing piece themselves, but many apps, APIs and older devices simply fail.
Why certificates expire and how automatic renewal works
Short lifetimes limit the damage when a private key leaks and make outdated certificates disappear quickly. Since March 2026 public certificates are valid for at most 200 days; the limit drops to 100 days in March 2027 and to 47 days in March 2029. Let’s Encrypt certificates last 90 days or less.
Lifetimes this short make manual renewal impractical. Automate it with the ACME protocol – certbot, acme.sh, Caddy, Traefik or your hosting panel do it for you – and then verify the result. Renewals fail quietly when DNS changes, a firewall blocks the validation request, or the web server isn’t reloaded after the new certificate is saved. This checker sees the certificate the server actually sends, so it catches a renewal that happened on disk but never went live.
Common certificate errors and how to fix them
Expired certificate (CERT_HAS_EXPIRED): renew it and reload the web server. Name mismatch (ERR_TLS_CERT_ALTNAME_INVALID): the certificate doesn’t list the hostname – include every name you use, such as both example.com and www.example.com, when you request it. A wildcard like *.example.com covers one level of subdomains, but not example.com itself.
Incomplete chain (UNABLE_TO_VERIFY_LEAF_SIGNATURE): point the server at the full-chain file instead of the certificate alone. Self-signed certificate (DEPTH_ZERO_SELF_SIGNED_CERT): replace it with one from a public CA – Let’s Encrypt is free. Untrusted root (SELF_SIGNED_CERT_IN_CHAIN): the certificate comes from a private CA that only devices set up by your organisation trust.
Questions and answers
How do I check when an SSL certificate expires?
Enter the domain and the verdict shows the expiry date and the number of days left. In a terminal you can run openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -enddate.
Why does my site say “Not secure” even though it has a certificate?
Either the certificate has a problem – it expired, was issued for another name or is served without its intermediate – or the page loads images, scripts or forms over plain HTTP (mixed content). Check the certificate here first, then look for http:// links to resources in the page.
Does a valid certificate mean a website is safe?
No. It means the connection is encrypted and the certificate matches the domain, so nobody in between can read or change the traffic. Phishing sites get free certificates too, so a valid certificate says nothing about who runs a site or whether they’re honest.
Can I check a mail server or another port?
Yes. Enter the port, for example 465 for SMTP over TLS, 993 for IMAP or 995 for POP3. Services that start unencrypted and switch to TLS with STARTTLS – such as SMTP on port 25 or 587 – can’t be checked this way, because their first bytes aren’t TLS.
What is the difference between SSL and TLS?
TLS is the successor to SSL. Every SSL version, and TLS 1.0 and 1.1 too, is outdated and switched off in current browsers; secure servers use TLS 1.2 or TLS 1.3. The certificates are the same either way – “SSL certificate” is just the name that stuck.