SSL Certificate Checker

Inspect the live TLS certificate served by any public domain over HTTPS. See whether HTTPS works, certificate issuer, subject and subject alternative names (SANs), validity window, days remaining until expiry, and optional grade signals from a third-party SSL API. Essential before renewals, after migrating hosts, or when debugging browser trust warnings. The check reflects the certificate presented at query time from the server's perspective — not a full penetration test or private-key audit.

How to Use the SSL Certificate Checker

Enter a public domain to inspect its live HTTPS certificate — issuer, validity dates, days remaining, SANs, and grade hints.

  1. Open SSL Certificate Checker.
  2. Enter the domain users type in the browser (example.com or www.example.com).
  3. Click Check SSL to query the live certificate via the SSL analysis API.
  4. Review the days-remaining badge — green, warning under 30 days, or expired.
  5. Read HTTPS status, Grade, Issuer, and Subject summary tiles.
  6. Check Valid from and Valid to dates for renewal planning.
  7. Scroll Subject alternative names to confirm every hostname you serve is covered.

What the checker inspects

The tool connects to the domain over HTTPS and reads the presented certificate's issuer, subject, SAN list, and notBefore/notAfter dates. Optional grade data reflects third-party analysis of TLS configuration visible to that service.

Worked example

  • After deploying a new site — confirm SAN includes both apex and www before launch.
  • Renewal drill — 14 days left on a manual DigiCert cert triggers procurement before auto-renewal gaps hurt production.
  • Migration — issuer changes to Let's Encrypt after moving to a new host confirms cert provisioning succeeded.

Common mistakes

  • Checking the wrong hostname variant — users on www.example.com need that name in SANs.
  • Ignoring expired intermediates — some errors are chain-related even when leaf expiry looks fine in isolation.
  • Assuming grade A+ means no vulnerabilities elsewhere in the stack.

Limitations

Depends on third-party API availability. Shows one certificate snapshot, not continuous monitoring. Does not test HSTS, CSP, or full cipher suite policy — pair with HTTP Headers Checker for response headers.

FAQ

What does the grade field mean?

When available, grade comes from the external SSL analysis provider and summarizes configuration quality. It is indicative — not a guarantee of perfect security.

Why does days remaining show a warning color?

Under 30 days remaining triggers a warning badge; expired certificates show an error state. Renew well before expiry to avoid outages.

What are Subject Alternative Names (SANs)?

SANs list all hostnames covered by one certificate — for example example.com and www.example.com. Browsers must match the hostname you visit to a SAN entry.

Can I check a certificate by IP address?

Enter the domain name visitors use in the browser. IP-only TLS checks depend on SNI and may not match what users see unless the cert includes the IP (uncommon).

Which provider performs the SSL check?

Certificate metadata is fetched via the public httpsornot.com porcelain API over HTTPS. Failures may occur if that service is unavailable.

Does this validate the private key?

No. Only the publicly presented certificate chain is inspected. Private keys never leave your server and are not accessed by this tool.

Why might HTTPS show an issue but my browser works?

Different clients, SNI settings, or intermediate chain paths can vary. Also verify you checked the exact hostname users type (apex vs www).

Will this check internal/certificate pinning?

No. It performs a standard public HTTPS handshake analysis suitable for internet-facing sites, not mTLS or pinned mobile apps.

How often should I check expiry?

Automated ACME renewers (Let's Encrypt, etc.) usually refresh at 30 days left, but manual certificates deserve calendar reminders — monthly checks are reasonable.

Is this a PCI or compliance audit?

No. It helps spot expiry and basic chain issues. Compliance requires broader policy, cipher, and process review by qualified assessors.