SSL Certificate Checker
The certificate your visitors are shown, and whether their browser will accept it. Certificates fail quietly — they expire on a Sunday, or they work on your laptop and warn on a phone because an intermediate is missing — and the first you hear is usually a customer telling you your site says "not secure".
What this checks
- Whether the certificate is currently valid, who issued it, and exactly how many days are left before it expires.
- Whether it actually covers the domain you typed, wildcards included — a wildcard covers one level, so *.example.com does not cover example.com itself.
- Whether the chain is complete. A missing intermediate works in a desktop browser that has it cached and fails on a phone that does not, which is horrible to diagnose without being told.
- Whether it is self-signed, which is always a browser warning for a visitor however correct it is on a staging server.
What this cannot tell you
- A valid certificate means the connection is encrypted and the name matches. It says nothing about whether the software behind it is safe, and anybody implying otherwise is selling something.
- This checks one address on port 443. A site can serve different certificates on different subdomains, and a mail or admin host is a separate check.
- We read the certificate and close the connection. We do not test which protocol versions or ciphers your server will accept, which is a different kind of scan.
Questions people ask
My certificate expires soon. What happens if I do nothing?
On the day it expires, every visitor gets a full-page browser warning telling them your site is not secure, and most of them leave. There is no grace period. If you use Let's Encrypt the renewal is usually automatic and the thing to check is that the automation is still running, because it fails silently when something on the server changes.
The site works for me but this says the chain is incomplete.
That is exactly the symptom. Your browser has the missing intermediate certificate cached from some other site, so it fills the gap without telling you. A visitor whose browser has not seen it — often on a phone, often on a first visit — gets a warning. The fix is to install the full chain your certificate authority supplied, not just the certificate.
What is a wildcard certificate and do I need one?
One that covers every subdomain at a single level: *.example.com covers www and shop and blog, but not example.com itself and not a.b.example.com. You need one if you run several subdomains. If you run one site, a certificate naming example.com and www.example.com is simpler and usually free.