SSL Checker

Quickly check whether a website has a valid, currently-active SSL certificate.

What is an SSL checker?

An SSL checker connects to a website over HTTPS and inspects the certificate it presents. It answers the questions that decide whether browsers will trust the connection: is the certificate issued by a trusted authority, is it valid for this exact hostname, and is it still in date? This SSL checker also shows who issued the certificate, how many names it covers, the TLS version and cipher used, and how many certificates were sent in the chain.

Strictly speaking, modern sites use TLS rather than the older SSL protocol, but "SSL certificate" is still the everyday name.

How the SSL check works

The tool opens a secure connection to the hostname on port 443, the standard HTTPS port, with full certificate verification switched on, exactly as a browser would. If verification fails, it reconnects without verification so it can still read the certificate and tell you why it was rejected. The connection has eight seconds to complete. Hostnames that resolve to private or internal addresses are not checked.

The hostname is compared with the certificate's common name and every Subject Alternative Name, including wildcard names such as *.example.com.

How to use the SSL checker

  1. Enter the hostname, such as example.com or www.example.com.
  2. Press Check SSL.
  3. Read the overall status first.
  4. Check the three key rows: valid for this hostname, issued by a trusted authority, and expiry.

Understanding your SSL checker results

Subject, issuer and names covered

The subject names who the certificate was issued to, and the issuer names the certificate authority that signed it, such as Let's Encrypt or DigiCert. Subject Alternative Names list every hostname the certificate covers.

Trusted authority

"Yes" means the chain leads to a root that browsers trust. "No" comes with the reason, such as a self-signed certificate or a missing intermediate certificate. Certificates from a company's own internal authority are trusted only on that company's devices, so they also show as not trusted here.

Expiry

The end date and days remaining. Thirty days or fewer is a warning, and seven days or fewer is critical.

TLS version, cipher and chain

TLS 1.2 and 1.3 are the current secure versions. The chain count shows how many certificates the server sent; most sites send their own certificate plus one or two intermediates.

Types of SSL certificate

Certificates differ in how much the authority checked before issuing them. Domain Validated (DV) certificates only prove control of the domain and are issued in minutes, often for free. Organisation Validated (OV) and Extended Validation (EV) certificates also confirm the business behind the site, and those details appear in the subject field. All three give exactly the same encryption; the difference is the identity check.

Common uses

  • Checking a new certificate straight after installing it.
  • Finding out why a browser shows a "not secure" or privacy warning.
  • Confirming a subdomain is covered by the certificate.
  • Seeing which certificate authority a site uses.
  • Checking which TLS version a server negotiates after a configuration change.

Common problems and fixes

Not valid for this hostname. The certificate covers other names, for example example.com but not www.example.com. Reissue it including every name visitors use.

Not trusted: unable to get local issuer certificate. The server is not sending the intermediate certificate. Install the full chain file from your certificate provider.

Self-signed certificate. Fine for testing, never for a public site. Replace it with a certificate from a trusted authority; free ones are available from Let's Encrypt through most hosts.

Connection failed. The site may not serve HTTPS at all, or port 443 may be blocked.

Related tools

Frequently asked questions

What does an SSL checker test?

It checks whether the certificate is issued by a trusted authority, whether it is valid for the hostname you entered and whether it is still in date. It also shows the issuer, the names covered, the TLS version, the cipher and how many certificates the server sent in its chain.

Why does my browser say the connection is not private?

The certificate failed a browser check: it may be expired, issued for a different name, self-signed or missing an intermediate certificate. Run the SSL checker on the exact hostname from the warning. The trusted and hostname rows show which problem it is, with the reason when trust fails.

What is an intermediate certificate?

Certificate authorities sign website certificates with intermediate certificates rather than their root. The server must send the intermediate along with its own certificate so browsers can build a path to a trusted root. A missing intermediate is a common cause of trust errors on some devices.

Does the SSL certificate cover www and non-www?

Only if both names are listed in the certificate. The checker compares the hostname you enter with the certificate's common name and every Subject Alternative Name, including wildcards. Check both example.com and www.example.com separately to make sure each one is covered.

Is SSL the same as TLS?

TLS is the modern successor to SSL. All the original SSL versions are outdated and disabled in browsers, and current sites use TLS 1.2 or TLS 1.3. The name "SSL certificate" stuck, but the same certificates are used for TLS connections today.

Are free SSL certificates safe to use?

Yes. Free certificates from authorities such as Let's Encrypt use the same encryption and are trusted by all major browsers. The main difference is that they are short-lived and usually renewed automatically by your host. Paid certificates can include extra validation of the organisation or a warranty.

Can I check SSL on a port other than 443?

This tool checks the standard HTTPS port, 443, which is what browsers use for normal website addresses. Services on other ports, such as mail servers, are not covered here. For mail servers, the SMTP Test can show whether a server offers encryption.