SSL Certificate Checker
ServerCheck a site's TLS cert: trust, hostname match, expiry.
How it works
Connects to the host over TLS (exactly like a browser) and reports what certificate it serves: who issued it, when it expires, which domains it covers, and whether it actually validates — chain trust, hostname match and expiry.
Try an example
About the SSL Certificate Checker
An HTTPS site is only as trustworthy as its TLS certificate, and a single expired or misconfigured certificate throws a scary browser warning that drives visitors away instantly. This free SSL certificate checker connects to any site and reports whether the certificate is trusted, matches the hostname and is still valid — along with the issuer, subject alternative names, expiry date and the full certificate chain.
Enter a domain and get a clear verdict in seconds. It's the quick way to catch an expiry or a chain problem before your users — or your uptime monitor — do.
What the SSL checker verifies
- Whether the certificate chain is complete and trusted by browsers.
- Whether the certificate matches the hostname you entered.
- The expiry date and how many days remain before renewal is due.
- The issuer (certificate authority) and subject alternative names (SANs).
- Any warnings, such as a self-signed certificate or a weak signature.
Common SSL errors and what they mean
- "Certificate has expired" — the validity period has passed; renew and reinstall it.
- "Name mismatch" — the certificate doesn't cover the domain requested (a missing SAN).
- "Incomplete chain" — an intermediate certificate is missing, so some clients can't build a path to a trusted root even though desktop browsers might.
- "Self-signed" — the certificate isn't issued by a recognised authority, so browsers won't trust it.
The intermediate-chain gotcha
The most common cause of "works in my browser but fails elsewhere" is a missing intermediate certificate. Modern desktop browsers can sometimes fetch or cache the missing link, hiding the problem — but many mobile apps, API clients and older systems can't, so they reject the connection. Checking from a server, as this tool does, surfaces the real chain a fresh client sees, which is why an external check catches issues a quick look in Chrome misses.
Frequently asked questions
What does the SSL checker test?
It connects over TLS and reports the certificate's chain trust, hostname match, validity dates, issuer and SANs, flagging problems like expiry, an incomplete chain, or a name mismatch.
Why does it say the hostname doesn't match?
The certificate's names (its common name and subject alternative names) don't include the exact domain you tested, so browsers would show a warning. The fix is to reissue the certificate with the correct name added as a SAN.
My site works in my browser but the checker reports an error — why?
Usually a missing intermediate certificate. Desktop browsers can sometimes work around it, but many clients can't. Installing the full chain (your certificate plus the intermediates your CA provides) resolves it.
How early should I renew a certificate?
Renew well before expiry, and ideally automate it — tools like Let's Encrypt and most hosting platforms renew every 60–90 days so certificates never lapse and trigger browser warnings.
Does checking a certificate expose any private data?
No. A TLS certificate is public information sent to every visitor. The checker only reads what any browser connecting to the site would already receive.