Free tool

SSL Certificate Checker

Inspect any HTTPS host's certificate. Expiry, issuer, SANs, TLS version, all the things browsers check, surfaced clearly.

What this tool actually does

Opens a TCP connection to port 443 on your domain, performs a TLS handshake, extracts the peer certificate, and verifies three things: it covers the hostname (checking CN and SANs), it hasn't expired (and isn't about to), and the TLS protocol version is acceptable.

What we don't check (yet)

Certificate chain validation against a custom trust store, OCSP stapling, HSTS headers. These are useful for security audits; for routine monitoring, "does this cert work in a modern browser" is what matters.

Why one-time checks aren't enough

A cert that's fine today might be expired in 60 days. Auto-renewal can silently fail. Continuous monitoring catches both, we re-check hourly and alert at 30 days and again at 14 days remaining, so renewal failures never become outages.

FAQ

What does the SSL checker actually verify?
We open a TLS connection to port 443, complete the handshake, extract the certificate, and verify: it covers your hostname (CN or SAN), it's not expired, the TLS version is current. Same logic browsers run on every page load.
My cert just renewed but the tool shows the old one. Why?
Most likely the web server wasn't reloaded after renewal. nginx, Apache, and Caddy all need a reload to pick up new cert files. Some renewal hooks (certbot --post-hook) handle this automatically; verify yours does.
What's the difference between days remaining and expiry date?
Days remaining is the practical metric, how long until you have a problem. The expiry date is the absolute timestamp. We report both. Anything under 14 days remaining is critical; under 30 days is a warning.
My TLS version shows 1.2, is that bad?
TLS 1.2 is acceptable but not ideal in 2026. TLS 1.3 is faster and more secure. Most modern web servers default to 1.3. If yours is stuck on 1.2, check your server config; you probably have legacy cipher suites enabled.
Related