SSL Certificate Checker
Check any domain’s SSL/TLS certificate. See validity, expiry date, days remaining, issuer, certificate authority, SANs, and key details instantly.
All Security ToolsHow the SSL Certificate Checker Works
This tool queries crt.sh, a public Certificate Transparency (CT) log search engine maintained by Sectigo. Every trusted SSL certificate issued by any public CA must be submitted to CT logs — this is a Google requirement enforced since 2018. crt.sh indexes these logs and provides a free JSON API.
The tool retrieves the most recently issued, non-expired certificate for a domain, parses the validity window, issuer chain, common name, and SANs, and runs a set of automated checks against it.
One important distinction: CT logs record certificates at issuance, not deployment. A certificate in the logs may or may not be the one currently live on the server. For live server verification, use tools like SSL Labs’ server test.
Validity and expiry
Shows issued date, expiry date, days remaining, and a visual progress bar for the certificate lifetime.
Certificate Authority
Identifies the issuing CA, Let’s Encrypt, DigiCert, Sectigo, ZeroSSL, and others, with the organisation name.
SANs
Lists all Subject Alternative Names covered, the domains and subdomains a single certificate secures.
Automated checks
6 automated checks: validity, days remaining, CA type, wildcard status, SAN count, and CT log presence.
Common Questions
Questions About the SSL Certificate Checker
Enter your domain in this tool and the expiry date and days remaining are shown immediately. Renewals should be scheduled at least 30 days before expiry. Let’s Encrypt certificates last 90 days and should be auto-renewed via certbot or similar tooling. Commercial certificates typically last 1 year.
Certificate Transparency is a framework that requires all publicly trusted CAs to log every certificate they issue to publicly auditable logs. This makes it possible to detect mis-issued certificates — ones issued for domains without the owner’s knowledge. Google Chrome requires CT compliance for all trusted certificates since 2018.
A wildcard certificate (e.g. *.example.com) covers all first-level subdomains under a domain — blog.example.com, shop.example.com, api.example.com — with a single certificate. It does not cover the root domain (example.com) by default, though most CAs include it as a SAN. Multi-level subdomains (sub.sub.example.com) are not covered.
Domain Validation (DV) certs verify domain control only — fastest and cheapest, used by Let’s Encrypt. Organisation Validation (OV) certs also verify the company behind the domain. Extended Validation (EV) certs go through the most thorough vetting and previously showed a green bar in browsers, though modern browsers have removed this visual distinction.
All major browsers show a full-screen warning page blocking access to the site. This effectively takes your site offline from the perspective of most visitors. Search engines may also flag the site. Renewal restores the connection instantly — the new certificate just needs to be deployed on the server. Always monitor expiry dates and automate renewal where possible.