SSL certificate checker
Connect to a site and check whether its HTTPS certificate is trusted, current and valid for the name, with the certificate chain, validity, TLS version and cipher suite.
Loading…
What you enter is sent to this site’s server, which looks it up or connects to it for you. Only public addresses can be checked; queries and results are not stored.
About this tool
Check a site’s HTTPS certificate: whether it is trusted, still valid and issued for the name you entered. Use it after installing or renewing a certificate, to see how many days are left before it expires, to find out why browsers show a certificate warning, or to check a TLS service on another port, such as 8443 or 993.
The result lists each certificate in the order the server sends it, with its names (SAN), issuer, validity, public key, signature algorithm, serial number and SHA-256 fingerprint, plus the TLS version, cipher suite, ALPN and handshake time. Trust is checked against Mozilla’s root store, the one Firefox uses. The name is sent to this site’s server, which connects to it; only public addresses can be checked, and nothing is stored.
How to use it
- Enter the “Domain or URL”, such as www.example.com.
- Keep the “Port” at 443 or enter another one.
- Select “Check”.
- Read the verdict, the days until expiry, the “Protocol” and the “Cipher suite”.
- Open each certificate under “Certificate chain” for its details, or select “Copy as JSON”.
Common questions
My browser shows a padlock. Why does the check say the issuer is not trusted?
The check uses only the certificates the server sends. This usually means the server does not send its intermediate certificate, which some browsers can fill in on their own. Configure the server to send the full chain, including the intermediate certificate, and check again.
Why does the TLS handshake fail?
The port may not speak TLS directly, such as a plain HTTP port or a mail port like 25 or 587 that starts in plain text and upgrades with STARTTLS. The check also offers only TLS 1.2 and TLS 1.3, so a server limited to older versions fails.
How are the days left counted?
As whole days from now until the certificate’s “Valid until” time, which is shown in UTC. Fewer than 30 days left are highlighted.
Can I check an IP address or a port other than 443?
Yes. Enter a public IP address and any port. For an IP address, the certificate only matches if it lists that IP among its names. The connection must open within 5 seconds and the handshake finish within 10 seconds.
What does ALPN “h2” mean?
During the handshake the check offers h2 and http/1.1. h2 means the server agreed to use HTTP/2 on this port, http/1.1 means HTTP/1.1, and “—” means it chose neither.
Related tools
DNS lookup
Look up a domain’s A, AAAA, CNAME, MX, NS, TXT, SOA, CAA and other records through public DNS servers, or the PTR name of an IP address.
HTTP request tester
Send GET, POST, PUT, DELETE and other requests from the server with your own headers and body over HTTP/1.1 or HTTP/2, and see the response status, headers and body, free of browser CORS limits.
HTTP status checker
Check the HTTP status code, redirect chain, response time and server of up to 20 URLs or domains at once.
IP address lookup
See your public IP address, or the country, region and city of any IPv4 or IPv6 address or domain.
Meta tag extractor
Extract the title, keywords, description, canonical link and Open Graph tags of up to 20 pages, and export them as CSV.
Web page source viewer
Fetch a page as a desktop or mobile browser or a search-engine crawler, then view its response headers and HTML source, formatted or as received, and download it.