SSL Certificate Checker
Enter a domain and see whether its HTTPS works, when its certificate expires, who issued it, which names it covers, and whether http redirects to https. A live connection test and the public certificate logs are combined into one plain report.
- Live HTTPS connection test
- Expiry, issuer and names
- https redirect and HSTS check
Done with the certificate? Grade the headers with the Security Headers Checker, or trace the redirect with the Redirect Checker.
Everything that decides whether HTTPS works
The report combines a live test with the public certificate record.
Live connection
A real HTTPS connection to the domain and to its www or non-www twin. It fails if the certificate is expired, untrusted or for another name.
Expiry
Days until the longest-lived valid certificate expires, with a warning below 30 days and an alert below 14.
Issuer
Which certificate authority issued it, whether it is a free automated one, and if several authorities are in use.
Names covered
Whether the certificate covers both the plain and www names, and whether it is a wildcard.
http to https
That the plain http address redirects to https with a permanent 301 or 308 redirect.
HSTS
Whether the server tells browsers to always use https.
How long a certificate may last
Browsers limit certificate lifetimes, and the limit is shrinking. Automatic renewal is now essential.
| Period | Maximum lifetime | What it means |
|---|---|---|
| Since September 2020 | 398 days | Browsers reject longer certificates. The tool flags them. |
| From 15 March 2026 | 200 days | New publicly trusted certificates can last at most about 6.5 months. |
| From 15 March 2027 | 100 days | Certificates will need renewing about four times a year. |
| From 15 March 2029 | 47 days | Manual renewal becomes impractical. Automation is the only option. |
How to check an SSL certificate
Three steps from a domain to a verdict.
Enter the domain
A name such as example.com. A full URL also works, and only the host name is used.
Read the verdict
See whether HTTPS works, how many days remain, who issued the certificate and which names it covers.
Fix what is flagged
Renew, add the missing name, set up the redirect or HSTS, then run the check again.
What a web page can and can't see
A website can't read the certificate a server presents. This tool combines two honest sources instead.
The live test
The check connects to the site over HTTPS from Cloudflare's network. The connection only succeeds if the certificate is valid, trusted and matches the name, which proves what matters most.
Certificate Transparency logs
Every publicly trusted certificate is recorded in public logs. The tool reads them for the issuer, names and dates. The site serves one of the valid ones, usually the newest, and some CDNs hold several at once.
What an SSL certificate is and why checking it matters
An SSL certificate, more exactly a TLS certificate, is a file that proves a website's identity and lets the browser encrypt the connection. A trusted certificate authority (CA) issues it for specific domain names, and it has a start and an end date. Without a valid one, browsers show a full-page warning instead of your site. With one, you get the padlock and https, which keeps traffic private and protects it from tampering. web.dev explains why HTTPS matters for every site, not just shops and logins.
A certificate checker answers a few practical questions. Does the https connection work right now? When does the certificate expire? Who issued it? Does it cover both the plain and www names? Does http redirect to https with a permanent redirect? A web page cannot read the certificate a server presents, so this tool combines a live HTTPS connection test from Cloudflare's network with the public Certificate Transparency logs, which record every publicly trusted certificate.
Expiry is the part that most often goes wrong, and the margin for error is shrinking. Under the CA/Browser Forum's Baseline Requirements, the maximum lifetime of a public certificate started stepping down in March 2026 and is scheduled to reach 47 days in March 2029. At those lifetimes, renewal has to be automatic. For search, web.dev's guide to enabling HTTPS says Google uses it as a positive quality indicator, though Google's page experience guidance adds that aspects beyond Core Web Vitals do not directly help a page rank higher. The bigger risk is an expired certificate, which makes a site unusable for visitors and crawlers alike.
When to run an SSL certificate check
Check before the expiry date and after anything that touches DNS, hosting or the CDN.
Before a certificate expires
See the days remaining and the expiry date. The tool warns under 30 days and flags anything under 14, which leaves time to fix a broken renewal.
After moving host, DNS or CDN
A move can leave the new server without a certificate, or serving one for another name. The live test shows whether browsers would accept what is served now.
During a domain or https migration
Confirm that every host name in the move is covered, that http redirects permanently to https, and that www and non-www both answer without a warning.
When visitors report a security warning
Find out whether the certificate expired, covers a different name, or is missing part of its chain. The list of logged certificates helps explain which.
When adding a subdomain or shop
Check that a new subdomain such as a blog, store or staging site is covered, either by its own certificate or by a wildcard.
In a client or technical audit
Record the issuer, expiry and renewal method for each domain. It shows who is responsible for renewal and whether the setup depends on one person remembering.
SSL certificate mistakes and how to fix them
Almost every certificate outage comes from renewal being manual or from a name being left out.
Renewing by calendar reminder
What goes wrong: A yearly reminder cannot keep up with certificate lifetimes that keep getting shorter. A missed email, a changed owner or a lapsed payment ends in an expired certificate.
The fix: Use automatic renewal, such as an ACME client or your host's managed certificates, and add an expiry alert as a second safety net. Check that renewal still works after server changes.
Covering only one of www and non-www
What goes wrong: A certificate for example.com only gives visitors a warning on www.example.com, or the reverse. Search engines can meet the same warning when they follow a link to the other name.
The fix: Add both names to the certificate, or use a wildcard, and redirect one version to the other with a 301 or 308 redirect.
Missing intermediate certificate
What goes wrong: A server that sends its own certificate but not the intermediate in the chain works in some browsers and fails in others, so the problem looks random.
The fix: Install the full chain bundle your CA provides, not just the single certificate file, and re-run the check from outside your own network.
Forgetting that http still works
What goes wrong: A valid certificate does not stop the http version loading. If it returns a page instead of redirecting, visitors and crawlers can stay on the unencrypted URL.
The fix: Redirect every http URL to its https equivalent with a permanent redirect. Add HSTS once https works on all subdomains, and update internal links and the sitemap to https.
Using Flexible mode behind Cloudflare
What goes wrong: In Cloudflare's Flexible mode, the visitor connection is encrypted but the connection from Cloudflare to your server is not, so the padlock can hide an unencrypted leg.
The fix: Install a certificate on the origin and use Full (strict) mode, which encrypts to the origin and validates its certificate.
Assuming the logs show what is served
What goes wrong: Certificate Transparency logs list every certificate issued for a name. A site, or a CDN holding several, serves only one of them, so the logs cannot say which is live.
The fix: Trust the live connection result first, then use the logged dates and issuers as supporting detail. If they disagree, check what the server actually presents.
SSL certificate terms explained
- TLS and SSL
- TLS (Transport Layer Security) is the protocol that encrypts https connections. SSL is its older name, which is still used in everyday speech, but modern certificates are used with TLS.
- Certificate authority (CA)
- An organisation trusted by browsers to issue certificates after checking that the applicant controls the domain. Some CAs are free and automated, others charge fees.
- Certificate Transparency (CT)
- A system of public, append-only logs where CAs record the certificates they issue. Domain owners and researchers can search them to spot unexpected or mistaken certificates.
- Subject Alternative Name (SAN)
- The list of host names a certificate is valid for. A browser accepts the certificate only if the name it visited appears in this list or matches a wildcard.
- Wildcard certificate
- A certificate for a name such as
*.example.com. The wildcard covers exactly one label, so it protectsblog.example.combut nota.blog.example.comor the bare domain. - Certificate chain
- The linked set of certificates from your server certificate through one or more intermediates to a root the browser trusts. A missing intermediate breaks trust in some clients.
- ACME
- The Automatic Certificate Management Environment, a protocol (RFC 8555) that a CA and an applicant use to automate domain verification and certificate issuance, and so renewal.
- HSTS
- A header that tells browsers to use only https for your site for a set time. Because it can lock out visitors if the certificate fails, use it only after https is reliable.
Related tools, guides and services
A valid certificate is the start of a secure site. These check what comes next.
Security Headers Checker
Grade HSTS, CSP, framing and cookie settings, with config ready to copy.
ToolRedirect Checker
Trace the http to https redirect and check that www and non-www resolve to one address.
ToolWebsite Health Check
Test HTTPS alongside speed, crawlability and on-page basics in one scored report.
GuideSEO audit errors that matter
See how HTTPS, mixed content and expired certificates rank among technical issues.
GuideRedesign SEO migration checklist
Plan redirects, https and monitoring for a launch or move without losing traffic.
ServiceSEO migration service
Get help moving domains or switching to https without losing search visibility.
Built by
Madhav Kushwaha
SEO, AEO, GEO & Digital Marketing Consultant in Kathmandu, Nepal, and trainer at ODcrU Academy and TechAxis Institute. An expired certificate is the most avoidable outage there is: visitors get a full-page warning and leave. I built this checker to show the expiry date and the live connection result in one place, and to be honest about what a web page can and can't read from a certificate.
SSL Certificate Checker: Frequently Asked Questions
More free SEO tools
A valid certificate is the start of a secure site. These tools check what comes next.