SSL certificate checker
What the SSL checker tests
This SSL checker opens a real TLS connection to each server, exactly like a browser, and reads the certificate the server presents. It then reports everything that can make a browser show a security warning or make visitors leave:
- Expiry: valid from and to dates and the number of days left. Anything expired or due within 14 days is critical.
- Hostname match: whether the domain is covered by the certificate's common name or Subject Alternative Names, including correct wildcard matching (
*.example.com covers www.example.com but not example.com or a.b.example.com).
- Trust and chain: whether the certificate chains to a trusted root, and how many certificates the server sends. A missing intermediate certificate works in some browsers but fails on many phones and in API clients.
- TLS version and cipher: TLS 1.3 and 1.2 are good. TLS 1.0 and 1.1 are deprecated and flagged.
- Key and signature: RSA or ECDSA key size and the signature algorithm.
- HTTPS enforcement: whether plain
http:// redirects to HTTPS, and whether an HSTS header is sent.
Bulk SSL check
Check SSL certificates in bulk
Expired certificates are almost always an oversight, usually on a forgotten subdomain, a staging site or a domain whose auto-renewal silently broke. Paste every domain you manage and this bulk SSL checker tests them in parallel, sorting the results so expired, mismatched and soon-to-expire certificates are at the top.
Set Warn when expiring within to match how you work: 14 days if renewal is automatic, 60 or 90 days if a person renews by hand. Download the CSV to keep a record or share it with a client. Let's Encrypt certificates last 90 days and are normally renewed around day 60, so a Let's Encrypt certificate with fewer than 30 days left usually means renewal has failed. Check the cron job or the hosting panel's SSL settings.
Reading the results
| Problem | Typical fix |
|---|
| Expired or expiring | Renew the certificate, or fix the automatic renewal job. |
| Hostname mismatch | Issue a certificate that includes this exact name, or both www and the bare domain. |
| Incomplete chain | Install the full chain (fullchain.pem), not just the leaf certificate. |
| Self-signed | Replace with a certificate from a public CA such as Let's Encrypt. |
| No HTTP redirect | Add a 301 redirect from HTTP to HTTPS in the server config. |
Advertisement
Mail and ports
Check a mail server or custom port
Email servers need valid certificates too, or mail clients show warnings and other servers may refuse to deliver securely. Choose Mail server mode and enter your mail host, such as mail.example.com. The checker connects on the port you choose:
- 587 and 25 (SMTP), 143 (IMAP) and 110 (POP3): connects in plain text, sends
STARTTLS, then upgrades to TLS.
- 465 (SMTPS), 993 (IMAPS) and 995 (POP3S): TLS from the first byte.
For any other service, such as a control panel on :8443 or :2083, add the port to the hostname in either mode. Many hosts block outgoing connections to port 25, so if port 25 fails try 587.
Good practice
SSL certificate good practice
- Monitor every hostname, including
www, subdomains, APIs and mail servers.
- Serve the full chain and disable TLS 1.0 and 1.1.
- Redirect all HTTP traffic to HTTPS with a single 301 and add an HSTS header once everything works over HTTPS.
- Keep the canonical URL on HTTPS. Check with the canonical tag checker and trace redirects with the URL redirect checker.
- Track domain renewals as well as certificates with the domain age checker.
Use Show certificate chain and PEM to see each certificate in the chain with its issuer and expiry, and copy the PEM for debugging. The checker only connects to public addresses and never sends credentials.
Renewals
Automating certificate renewals
On CyberPanel, cPanel and most hosting panels, Let's Encrypt certificates renew automatically, but renewal can fail silently when DNS points elsewhere, port 80 is blocked or a domain was removed. Add your domains to a monthly bulk check here, and set the warning window to 30 days so you have time to fix a failed renewal before visitors see an error.
FAQ
SSL Certificate Checker: frequently asked questions
What is an SSL checker?
An SSL checker connects to a server over TLS and reports details of the certificate it presents: expiry date, issuer, which names it covers, whether it is trusted, and the TLS version in use.
How do I check when my SSL certificate expires?
Enter your domain and click Check SSL certificates. The Expires column shows the date and the Days left column shows how long remains.
Can I check many SSL certificates at once?
Yes. Paste up to 50 domains, one per line. They are checked in parallel and sorted with the most urgent problems first.
What does hostname mismatch mean?
The certificate does not list the domain you checked. Browsers will show a warning. Get a certificate that includes that exact name.
What is an incomplete certificate chain?
The server sends its own certificate but not the intermediate certificate that links it to a trusted root. Install the full chain file to fix it.
Can I check the SSL certificate of a mail server?
Yes. Choose Mail server mode and pick the port. Ports 25, 587, 143 and 110 use STARTTLS; 465, 993 and 995 use implicit TLS.
Which TLS version should my server use?
TLS 1.3, with TLS 1.2 as a fallback. TLS 1.0 and 1.1 are deprecated and are flagged as a problem.
Is this SSL checker free?
Yes, with no sign-up. You can export results as CSV.