Skip to content
SecAIQ

SSL/TLS Certificate Checker

Check when a domain's SSL/TLS certificate expires, who issued it, and whether it actually covers that domain.

Check when a domain's SSL/TLS certificate expires, who issued it, and whether it actually covers that domain, useful before trusting a login page, or before an expiring certificate takes your own site down unexpectedly.

Frequently Asked Questions

What does it mean if a certificate doesn't cover the domain?

It usually means the certificate was issued for a different domain or a different subdomain pattern, browsers will show a warning, and it's a signal worth being cautious about, especially on a login or payment page.

How often should I check my own site's certificate?

Most certificates renew automatically, but it's worth checking a few weeks before a known expiry date, an expired certificate takes a site offline for visitors with no warning.

Related: Link & Phishing Checker

Enter just the domain, if you paste a full address the domain part is used.

Try an example

The badssl.com examples are official test domains that deliberately present broken certificates.

This check runs server-side

Reading a certificate requires a TLS handshake with the other server, which a browser can't do on its own. So unlike the other tools on this site, this query is made by this site's own server.

The domain you enter isn't logged, it's only used for the duration of the request. No page content is downloaded, only a handshake is performed, the certificate is read, and the connection is closed.

What to look at

  • Days remaining: plan a renewal once it drops under 30 days, under 7 is urgent.
  • Chain: a missing intermediate certificate can block some browsers and mobile apps entirely, while desktop looks fine.
  • Covered names: if a subdomain you just launched isn't listed, visitors will see a warning there.
  • Signature and key: an old SHA-1 signature or 1024-bit RSA key is no longer accepted by modern browsers.

Good to know

  • An expired certificate doesn't slow a site down, it makes it effectively unreachable behind a full-page security warning. Most visitors turn back at that screen.
  • Automatic renewal (like Let's Encrypt) can still fail silently: a changed server configuration, an expired authorization, or a disabled scheduled task is enough. Monitoring matters as much as setting up renewal.
  • Self-signed certificates are fine for internal systems, but on a public-facing site they show visitors a warning and train people to click through it.
  • This tool shows whether a certificate is valid, not whether a site is safe. Phishing sites with perfectly valid certificates are common.