SSL certificate check
Check that your website's certificate is valid, matches your domain and is trusted by browsers. We also warn you before it expires.
What the check verifies
On every HTTPS connection, the browser verifies the server's certificate. If a check fails, visitors see a warning and many apps refuse to connect. The tool connects to your server on port 443 and checks three things separately:
- Validity: whether the certificate is already valid and has not expired. We warn you when fewer than 14 days remain.
- Hostname: whether the certificate includes the domain you entered in its Subject Alternative Name field.
- Trust chain: whether a publicly trusted certificate authority issued the certificate and the server also sends the intermediate certificates.
How to read the result
Each check comes with an explanation. For chain errors, we also show the technical code (for example UNABLE_TO_VERIFY_LEAF_SIGNATURE) that your server administrator can use.
- Valid: all three checks passed.
- Needs attention: the certificate expires soon, or the chain could not be verified. The site may work in a browser but fail for some clients.
- Not valid: the certificate has expired, does not match the domain or is not trusted by public clients. Visitors will see a warning.
Common problems and how to fix them
- Expired certificate: automatic renewal usually failed. Check that your ACME client (such as certbot) or your host's service is running and that the server loads the new certificate after renewal. Since March 2026, public certificates may be valid for at most 200 days, and the limit keeps shrinking, so manual renewal is no longer practical.
- Missing intermediate certificate: the server sends only the domain certificate. Configure the full chain (fullchain), not the certificate alone.
- Certificate for a different name: typically the www or non-www variant is missing, or the server returns another site's certificate. Issue a certificate covering every name you use.
- Self-signed or internal authority: suitable only for internal systems. A public website needs a certificate from a public authority, such as the free Let’s Encrypt.
- Outdated TLS: if the server does not offer TLS 1.2 or 1.3, the tool cannot connect. Disable older protocol versions.
What the check cannot tell you
- It does not check revocation or the full cipher configuration. For a detailed TLS configuration analysis, use a tool such as SSL Labs.
- It checks only port 443 and one of the domain's IP addresses. If the site runs on several servers, they may have different certificates.
- A valid certificate means an encrypted connection to the right server, not a secure application. Only a penetration test reveals application vulnerabilities.
- The tool connects only to public addresses, and we do not store the result.
Common questions
How often should a certificate be renewed?
Set up automatic renewal. Since March 2026, public certificates are valid for at most 200 days, and the limit will shrink step by step to 47 days by 2029, so manual renewal is no longer realistic.
What is the difference between SSL and TLS?
SSL is the older name of the protocol. Today TLS 1.2 and 1.3 are used, but the term “SSL certificate” is still common.
Why does my browser show an error when the tool says the certificate is valid?
The browser may have connected to a different name (with or without www) or a different server, or the page loads some content over unencrypted HTTP. Check the domain's other names too.
Want to know whether the website is actually secure?
A valid certificate is the foundation. In a penetration test, we check whether an attacker could reach your data through the application, its API or the infrastructure.
Penetration testing