Free tool

SSL Certificate Checker

Check any website’s SSL certificate: who issued it, when it expires, whether the chain is trusted and whether it covers the domain.

Check a certificate

Checks the certificate served on port 443. Enter a domain name such as example.com or www.example.com.

What the SSL checker looks at

The checker opens a TLS connection to the domain on port 443, the way a browser does, and reads the certificate the server sends. It then reports:

  • Issuer: the certificate authority that signed it, such as Let’s Encrypt, Google Trust Services or Sectigo.
  • Expiry date and days left: when the certificate stops being valid. Browsers show a full-page warning from that moment.
  • Chain of trust: whether the certificate leads to a trusted root through the intermediates the server sends. A missing intermediate works in some browsers and fails in others, apps and API clients.
  • Hostname match: whether the domain you entered is one of the names the certificate covers, including wildcards like *.example.com.
  • Protocol: the TLS version negotiated, such as TLSv1.3.

Certificates from Let’s Encrypt and most automated issuers last 90 days or less and renew in the background. When renewal breaks, for example after a DNS or firewall change, nothing tells you until visitors see the warning. Continuous monitoring catches it while there are still days left.

Frequently asked questions

How do I check when my SSL certificate expires?+
Enter your domain above. The checker shows the expiry date and the number of days left. From a terminal you can also run openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -enddate.
What does "chain not trusted" mean?+
The certificate could not be linked to a trusted root authority. The usual causes are a self-signed certificate, a private certificate authority, or a server that does not send the intermediate certificate. Install the full chain (often called fullchain.pem) on the server to fix the last one.
Why does the hostname not match?+
The certificate does not list the name you entered. A certificate for example.com does not cover www.example.com unless both are included, and a wildcard covers one level of subdomain only.
Which ports and addresses can I check?+
The checker connects to port 443 on public addresses only. Domains that point to private, local or reserved networks are refused.
How often should I check my certificate?+
Automated renewals usually run 30 days before expiry, so a failed renewal leaves you a few weeks at most. Checking every day is enough to catch it. With SSL/TLS verification turned on, UptimeDuck checks it on every HTTPS check, so you hear about a problem straight away.
Can UptimeDuck alert me before my certificate expires?+
Yes. Turn on SSL/TLS verification on an HTTPS monitor and UptimeDuck alerts you when the certificate expires within 7 days or has expired, alongside downtime alerts. Create a free account to set it up.

Get alerted before a certificate expires

UptimeDuck checks your sites from multiple regions, can verify the certificate on every HTTPS check and alert you by email, Slack, Discord and more before visitors see a warning.

Create a free account

The Free plan includes 10 uptime monitors checked every 3 minutes. See all plans.

More free tools