SSL Checker
Point it at any domain and read the certificate its server presents: who issued it, what it covers, whether the chain and hostname validate, the TLS protocol in use — and a plain countdown of the days you have left.
🔒 TLS certificate
Free with myeventwatch — 3 monitors included, no card required. Expiry and downtime alerts go to your inbox (and Telegram, webhooks and more) before they become outages.
Do not wait for the countdown to reach zero: Monitor this free with myeventwatch and get alerted before expiry.
What a certificate check tells you
A TLS certificate is a small public document with outsized consequences. It binds a public key to a list of names, it is signed by an issuer your visitors' browsers must trust, and it carries hard start and end dates. This checker performs a genuine TLS handshake against the domain on port 443 — the same negotiation a first-time visitor's browser performs — and reports what comes back. The issuer tells you which certificate authority stands behind the site, useful when you inherit infrastructure and need to know where renewals live. The subject and SAN list show exactly which hostnames the certificate covers; a missing name — the bare domain without www, or a forgotten subdomain — is one of the most common causes of browser warnings on otherwise healthy sites.
The validity window is the part with a deadline. The checker converts the not-after date into a days-remaining countdown and colours it: comfortable beyond ninety days, amber inside ninety, red inside thirty. It also reports whether the chain validates — the server must present not just its own certificate but the intermediate certificates linking it to a trusted root, in the right order — and whether the hostname matches, and which protocol version was negotiated, so an ageing TLS 1.0 endpoint is visible at a glance.
Why certificates expire at the worst time
Modern certificates are deliberately short-lived. Automated issuers commonly grant ninety days, which is good security practice and a relentless operational treadmill: twelve renewals a year, each one a small chance for an automation to fail silently — a DNS challenge that no longer validates, a renewal script on a decommissioned server, a plugin that stopped running after an update. The failure mode is brutal in its simplicity: one morning the certificate is expired, every browser shows a full-page warning, and most visitors leave rather than click through. Search engines, payment providers and API clients are even less forgiving. The only reliable defence is to know the date and be reminded about it, which is why every result on this page offers free continuous monitoring through myeventwatch: the checker shows you today's countdown, the monitor makes sure you hear about it at thirty days, fourteen days, and seven.
Reading a problem result
If the checker reports an error instead of a certificate, the message names the failure precisely. No TLS means nothing answered on port 443 — the site may be HTTP-only or firewalled. Expired and self-signed results still show the presented certificate's issuer and dates, because a broken site still has a certificate worth reading. A hostname mismatch means the certificate's name list does not include the domain you entered — check whether the site is meant to be reached by a different name, or whether the wrong certificate is being served. An untrusted chain almost always means a missing intermediate certificate on the server, which some browsers mask by fetching it themselves — your regulars may see no problem while every new visitor does.
Frequently asked questions
What does the SSL checker show?
The certificate a server actually presents on port 443: issuer, subject, the names it covers (SANs), its not-before and not-after dates with a days-remaining countdown, the negotiated TLS protocol, and whether the chain validates and the hostname matches.
Why does my certificate show as invalid when the site loads fine for me?
Browsers cache and forgive in ways a fresh handshake does not. Common causes are an expired intermediate, a chain that is valid only because a browser filled the gap from its cache, or a certificate whose name list does not include the exact hostname. The checker reports what a strict, first-time client sees.
How many days before expiry should I act?
Renew or re-issue as soon as you are inside 30 days; treat anything under 90 days as scheduled work. Automated certificates often live only 90 days in total, so a healthy setup renews them continuously rather than at the deadline. This page turns the countdown amber under 90 days and red under 30.
Does this checker support ports other than 443?
No. For safety and simplicity the checker only ever connects to the standard HTTPS port of the domain you name — no custom ports, paths or IP addresses.
Can I be alerted before my certificate expires?
Yes — that is exactly what the "Monitor this free" button on a result sets up. myeventwatch watches the certificate continuously and alerts you ahead of expiry instead of you having to remember to re-check.