SSL Certificate Checker
Check any domain’s SSL/TLS certificate. See validity, expiry date, days remaining, issuer, certificate authority, SANs, and key details instantly.
All Security ToolsEnter a domain to check its certificate expiry, chain, TLS version and the names it covers.
The missing intermediate problem. If your server sends only its own certificate without the intermediates that link it to a trusted root, desktop browsers usually still work, because they have cached those intermediates from other sites. Mobile browsers, API clients and payment gateways often do not, so the site fails for exactly the visitors you cannot see in your own testing. That check is the most valuable thing on this page.
Expiry is not the only thing that breaks. A certificate can be perfectly valid and still fail, if it does not cover the hostname being requested, if it is self-signed, or if the server only offers a TLS version browsers have dropped.
Certificate Transparency. Every publicly trusted certificate must be recorded in public logs. Reading through the issuance history for your own domain is how mis-issued certificates get spotted, so it is worth a glance even when everything looks healthy.
How this checker reads certificate data without ever opening a TLS connection
A browser tab cannot open a raw TLS socket to an arbitrary domain on port 443 and inspect the certificate chain the way a command line tool like openssl s_client can. JavaScript in a page has no API for that. So this tool takes a different, genuinely clever route: it queries crt.sh, a free public search interface over Certificate Transparency logs run against Sectigo’s CT log aggregation, and reads back the most recently logged certificate for the domain you entered.
That is an important distinction to sit with. This tool is not connecting to the target server at all. It is asking a public log of every certificate that has ever been issued for that domain by a CT compliant certificate authority, a system that exists precisely because of the 2011 DigiNotar breach and the resulting industry wide push for auditable certificate issuance. The domain you type is sent to crt.sh over HTTPS as a query parameter, nothing more.
From your domain to a rendered certificate card
www., so https://www.Example.com/path and example.com resolve identically.
crt.sh/?q=domain&output=json&exclude=expired&deduplicate=Y, asking for non-expired, deduplicated certificate entries matching the domain across every logged CT entry.
name_value or common_name actually contains the domain or its wildcard form, then sorted by expiry date descending so the most current certificate wins.
CN= and O= components to extract a readable authority name and organisation. Subject Alternative Names come from splitting the multiline name_value field, deduplicated into a clean list.
What the results card actually shows
| Field | Source |
|---|---|
| Common Name | cert.common_name from the CT log entry |
| Issued / Expires | not_before and not_after, with a progress bar showing elapsed validity period |
| Certificate Authority | Parsed CN and O fields from cert.issuer_name |
| Validity period | Days between not_before and not_after, useful for spotting a 90-day Let’s Encrypt cert versus a longer commercial one |
| Serial / crt.sh ID | cert.id, the log entry’s own identifier, not the X.509 serial number itself |
| Subject Alternative Names | Deduplicated list parsed from name_value |
A handful of automatic checks run against that data too: whether the cert is currently valid, whether expiry is comfortably more than 30 days out, whether it was issued by Let’s Encrypt, detected by matching known intermediate names like R3 or E1 in the issuer CN, and whether it is a wildcard certificate covering every subdomain.
openssl s_client -connect domain:443, is the authoritative source.Two things the expiry logic handles
Three-tier urgency banding
Expired shows red immediately. Fourteen days or fewer remaining triggers a critical red renew-now warning. Thirty days or fewer shows an amber schedule-renewal notice. Anything beyond that is a calm green valid state, matching the rhythm most CAs use for renewal reminder emails.
Let’s Encrypt detection
Because Let’s Encrypt certificates are always 90 days and auto-renewable, spotting one changes the interpretation of a looming expiry date entirely, it is expected and usually handled by automation like Certbot rather than a sign of neglect.
- RFC 5280 defines the X.509 certificate and CRL profile, the structure behind every field this tool displays.
- RFC 6962 defines Certificate Transparency, the logging system crt.sh indexes.
- crt.sh is the search interface this tool queries directly, run by Sectigo against multiple public CT logs.
- Let’s Encrypt, how it works explains the 90-day automated issuance model this tool specifically detects.
Certificate problems this catches
Checking how many days remain before a certificate needs renewal without logging into a hosting panel, confirming a domain’s certificate covers the subdomains you expect via its SAN list, verifying which certificate authority a vendor or partner site actually uses, and spotting whether a site is running a wildcard certificate before deciding whether a new subdomain will be automatically covered.
Common Questions
Questions About the SSL Certificate Checker
Enter your domain in this tool and the expiry date and days remaining are shown immediately. Renewals should be scheduled at least 30 days before expiry. Let’s Encrypt certificates last 90 days and should be auto-renewed via certbot or similar tooling. Commercial certificates typically last 1 year.
Certificate Transparency is a framework that requires all publicly trusted CAs to log every certificate they issue to publicly auditable logs. This makes it possible to detect mis-issued certificates — ones issued for domains without the owner’s knowledge. Google Chrome requires CT compliance for all trusted certificates since 2018.
A wildcard certificate (e.g. *.example.com) covers all first-level subdomains under a domain — blog.example.com, shop.example.com, api.example.com — with a single certificate. It does not cover the root domain (example.com) by default, though most CAs include it as a SAN. Multi-level subdomains (sub.sub.example.com) are not covered.
Domain Validation (DV) certs verify domain control only — fastest and cheapest, used by Let’s Encrypt. Organisation Validation (OV) certs also verify the company behind the domain. Extended Validation (EV) certs go through the most thorough vetting and previously showed a green bar in browsers, though modern browsers have removed this visual distinction.
All major browsers show a full-screen warning page blocking access to the site. This effectively takes your site offline from the perspective of most visitors. Search engines may also flag the site. Renewal restores the connection instantly — the new certificate just needs to be deployed on the server. Always monitor expiry dates and automate renewal where possible.
From the blog
Security writing without the scare tactics
Practical explanations of hashing, headers, certificates and consent, aimed at people who have to ship something this week.
