SSL Checker - Verify SSL Certificate Validity and Expiry Date

SSL Checker - Verify SSL Certificate Validity and Expiry Date

What Is an SSL Certificate Checker?

An SSL certificate is a file installed on a web server that does two things at once: it encrypts the traffic between a visitor's browser and the server, and it proves the server genuinely belongs to the domain it claims to serve. The protocol is formally called TLS now, though the name SSL has stuck.

A certificate checker fetches that certificate and reports what it actually contains — who issued it, which hostnames it covers, when it expires, and whether the chain linking it to a trusted authority is complete. This matters because your own browser is not a reliable witness. Desktop browsers quietly repair certain configuration faults behind the scenes, so a site that looks fine to you can be failing for mobile visitors and crawlers. A checker shows you the certificate as the server actually sends it, with nothing filled in.

How to Use This Tool?

1. Enter the domain name, without http:// or https://
2. Run the check
3. Review the issuer, validity dates, covered hostnames, and chain status

Check the exact hostname people use. A certificate can be valid for example.com and invalid for www.example.com, so if visitors are reporting a warning you cannot reproduce, test the version they are visiting rather than the one you type out of habit.

Understanding the Results

Validity dates are usually the field to act on. Most certificates are now issued for ninety days, which means renewal has to be automated — and an automated renewal can fail silently for weeks before anyone notices. The expiry date is something to monitor, not something to react to.

The issuer is the certificate authority that signed it. Browsers trust only the authorities in their own root store, so a certificate from an internal or private CA will be rejected no matter how correctly it is installed.

Covered hostnames come from the Subject Alternative Name list. The older Common Name field is no longer used for matching, so what matters is whether the exact hostname being visited appears in the SAN list. A certificate covering only the root domain will fail on the www version, which is one of the most common causes of a warning appearing on one version of a site but not the other.

Chain status is the result worth reading most carefully. A certificate links back to a trusted root through one or more intermediate certificates, and the server is responsible for sending them. If an intermediate is missing, desktop browsers often fetch it themselves and show no warning at all, while mobile browsers, older clients, and crawlers fail outright. This is the fault that hides most effectively from the person who deployed it.

What the Error Codes Mean

If a browser showed an error before you arrived here, the code tells you which check failed:

• NET::ERR_CERT_COMMON_NAME_INVALID | The certificate does not cover this hostname
• NET::ERR_CERT_AUTHORITY_INVALID | The issuer is not trusted, or the chain is incomplete
• NET::ERR_CERT_DATE_INVALID | The certificate has expired — or the device clock is wrong
• ERR_SSL_PROTOCOL_ERROR | The handshake failed before the certificate was examined
• ERR_SSL_VERSION_OR_CIPHER_MISMATCH | The server offers no TLS version the browser accepts
• SSL certificate problem: unable to get local issuer certificate | curl's wording for an incomplete chain

ERR_SSL_PROTOCOL_ERROR and ERR_SSL_VERSION_OR_CIPHER_MISMATCH are worth separating from the rest. Neither is a problem with the certificate itself — the connection failed during the handshake, before the certificate was ever examined. Our guide to SSL certificate errors covers each code in detail, including the causes that sit on your own machine rather than on the server. 

When Is This Tool Useful?

• Confirming a certificate is installed correctly after moving to a new host or server
• Checking that a newly added subdomain is covered rather than falling back to a default certificate
• Diagnosing a security warning that visitors report but you cannot reproduce
• Verifying the chain is complete, which your own browser may be concealing
• Confirming automated renewal is actually running, rather than assuming it is
• Checking a certificate before pointing production traffic at a new server

A warning you cannot reproduce almost always comes down to one of two things: the chain, or the specific hostname. Both are visible here.

If the site fails to load entirely rather than showing a warning, the certificate may not be the problem at all. A ping test confirms the server is reachable, and checking whether port 443 is open confirms something is listening for encrypted traffic in the first place. After a migration, it is also worth confirming the DNS records point to the new server before investigating a certificate on a host that is no longer serving the domain.

What This Tool Does Not Do

The certificate reported here is the one the server presents to this request, from this location, at this moment. Servers using SNI can present different certificates for different hostnames, and a CDN may serve a different certificate from a different edge location than the one that answered here.

The check also reports the certificate, not the page. A perfectly valid certificate will still produce a "not secure" label if the page loads images or scripts over plain HTTP, and it will not tell you whether HTTP is still serving content alongside HTTPS — tracing the redirect answers that separately.

Most importantly, a valid certificate is not a statement about the site. It confirms the connection is encrypted and the domain was verified, nothing more. Fraudulent sites obtain valid certificates routinely, and they are free.

Frequently Asked Questions

How do I check when an SSL certificate expires?

Enter the domain above and run the check. The result shows the certificate's valid-from and valid-to dates, along with how many days remain. Most outages of this kind happen because nobody was watching the expiry date, not because the renewal itself failed.

How can I check if a site's SSL certificate is valid?

Run the domain through the tool. A valid certificate must be unexpired, issued by a trusted authority, cover the exact hostname you visited, and present its full chain. The check reports each of these separately, so you can see which one is failing rather than just that something is wrong.

What is the difference between SSL and TLS?

TLS is the current protocol; SSL is its predecessor and has been deprecated for years. Every certificate issued today is a TLS certificate. The name SSL survives in common usage, in product names and in configuration directives, which is why the two terms are used interchangeably despite describing different things.

My certificate is valid, but the site still says "not secure" — why?

Almost always mixed content: the page loads over HTTPS but pulls an image, script or stylesheet over plain HTTP. The certificate is fine; the page is not. Open the browser console to find which resource is being requested insecurely.

Why does my site show a warning on mobile but not on desktop?

This usually indicates an incomplete certificate chain. Desktop browsers often fetch the missing intermediate certificate automatically, while mobile browsers and crawlers do not.

Does a padlock mean a website is safe?

No. The padlock confirms the connection is encrypted and the domain was verified. It says nothing about whether the site itself is trustworthy — fraudulent sites routinely obtain valid certificates.

Why does my certificate work for example.com but not the www version?

Each hostname must be listed on the certificate as a subject alternative name. If the www variant was not included, browsers will reject it even though the base domain works perfectly.

Does SSL affect SEO?

Directly, only slightly — Google has treated HTTPS as a lightweight ranking signal since 2014, and it will not lift a page on its own. The real cost of a certificate error is indirect: visitors do not click past a full-page browser warning, and crawlers can fail to fetch pages served with an invalid certificate, which affects indexing.