Check a website's TLS certificate: expiry date and days left, issuer, covered hostnames (SANs), hostname mismatches and chain problems.
An SSL certificate checker connects to a website over HTTPS and reads the TLS certificate it presents. This tool shows whether the certificate is within its validity dates, whether it covers the hostname you entered, whether the server sends a complete chain to a trusted certificate authority, who issued it and how many days it has left, so you can catch an expiring, mismatched or broken certificate before visitors see a browser warning.
example.com or www.example.com, or a public IP address. Leave out https://, paths and port numbers.| Field | Meaning |
|---|---|
| Valid | The certificate is inside its validity dates, covers the hostname you checked, and chains to a trusted certificate authority. |
| Expired / Not yet valid | Today is outside the certificate's validity period. Browsers will show an error. |
| Hostname mismatch | Neither the subject CN nor any SAN covers the name you checked, e.g. a certificate for example.com served on www.example.com. |
| Trusted chain | The certificates the server sent link its certificate to a root certificate authority that browsers and operating systems trust. |
| Incomplete chain | The server didn't send an intermediate certificate. Browsers often fill the gap themselves, so the site can look fine in Chrome while curl, mobile apps and API clients fail with "unable to get local issuer certificate". |
| Self-signed / Untrusted issuer | The certificate wasn't issued by a publicly trusted authority, which is common on test servers, appliances and internal networks. Browsers show a security warning. |
| Certificates sent by the server | The chain in the order the server presents it: its own certificate first, then the intermediates that link it to a root. |
| Subject | The common name (CN) and organisation (O) the certificate was issued to. Domain-validated certificates usually have no organisation. |
| SAN | Subject Alternative Names: every hostname the certificate is valid for. Browsers use this list, not the CN. A *.example.com entry covers one level of subdomains only. |
| Issuer | The certificate authority that signed it, e.g. Let's Encrypt, Google Trust Services, Sectigo or DigiCert. |
| Valid from / to, Days remaining | The validity window. Automated certificates usually renew when about a third of their lifetime is left. |
| Serial, Signature | The certificate's unique serial number and signature algorithm, useful when comparing certificates or contacting the CA. |
The chain is checked against a standard set of trusted root certificates, like the ones browsers and operating systems ship with. Individual devices can trust a slightly different set, especially old phones and corporate machines. The tool doesn't check whether a certificate has been revoked (OCSP or CRL), which TLS versions and ciphers the server accepts, or whether pages load insecure content. An expired certificate is reported as expired without evaluating its chain. To inspect the chain yourself:
openssl s_client -connect example.com:443 -servername example.com -showcertsOnly port 443 is checked, with a 10-second connection timeout. Private and reserved IP addresses can't be checked, and lookups are limited to 50 per hour.
CAA record that doesn't allow the CA. Check CAA records with a DNS Lookup.example.com and www.example.com in its SANs if both are used.fullchain.pem rather than cert.pem; in nginx, ssl_certificate must contain the full chain.Certificates are getting shorter-lived: the maximum lifetime of publicly trusted certificates dropped to 200 days in March 2026 and is scheduled to reach 47 days by 2029. Automated renewal, and a periodic check like this one, matter more each year.
Enter the hostname above and read Valid to and Days remaining. From a terminal: echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates.
If the dates, hostname and chain all check out, look elsewhere: the certificate may have been revoked, the page may load some resources over plain HTTP (mixed content), the device clock may be wrong, or antivirus software or a corporate proxy may be intercepting HTTPS with its own certificate.
curl couldn't build a chain from the server's certificate to a root it trusts. On a public site this is almost always an incomplete chain, which this tool reports as Incomplete chain; fix it by serving the full chain. If the certificate comes from a private CA, add that CA to the client's trust store instead.
TLS is the modern protocol that replaced SSL; all SSL versions are obsolete. "SSL certificate" is simply the familiar name for a certificate used with TLS.
No. *.example.com covers www.example.com and shop.example.com, but not example.com itself or deeper names like a.b.example.com. The bare domain must be listed as its own SAN.