SSL Certificate Checker
Check a site’s HTTPS certificate: is it trusted, does it match the name, when does it expire, who issued it, and which TLS version and cipher the server uses.
An expired or misconfigured certificate takes a site offline just as surely as a crashed server. Check any HTTPS site – or a mail server on 465, 993 and 995 – to see whether the certificate is trusted, covers the name you typed, when it expires, who issued it, whether the full chain is installed and which TLS version and cipher the server negotiates.
How to use it
- Enter the hostname, e.g.
example.comormail.example.com. - Keep port 443 for websites, or choose a mail or admin port.
- Fix anything marked red first: expired, untrusted, wrong name, outdated TLS.
What the problems mean
- Not trusted – usually the intermediate certificate is missing. Configure the server with the full chain (
fullchain.pemfor Let’s Encrypt). - Doesn’t match the name – the certificate was issued for another name. Re-issue it including every name visitors use, with and without
www. - Outdated protocol – TLS 1.0 and 1.1 are switched off in current browsers. Allow only TLS 1.2 and 1.3.
Certificate lifetimes are shrinking
Public certificates are moving to much shorter maximum lifetimes over the next few years. Manual renewal won’t keep up – use automatic renewal (certbot, acme.sh, your host’s AutoSSL) and monitor the expiry date.
Frequently asked questions
The certificate is valid but browsers still warn – why?
Most often the server doesn’t send the intermediate certificate. Browsers that haven’t seen it before can’t build the chain. Install the full chain (fullchain.pem for Let’s Encrypt).
How early should I renew?
Let’s Encrypt renews automatically at 30 days left. For paid certificates, renew two to four weeks ahead – and from 2026 maximum lifetimes keep shrinking, so automate renewal wherever you can.
Which TLS versions should a server allow?
TLS 1.2 and TLS 1.3 only. TLS 1.0 and 1.1 are deprecated and blocked by current browsers.
More tools
All tools →Ping Test
Ping any website or public IP from our server: reply times, packet loss, jitter and TTL for each packet – check whether a host is up and how healthy the path is.
Open tool Network troubleshootingTraceroute (MTR)
See every router between our server and a destination, with packet loss and latency per hop (MTR report) – find where a connection slows down or breaks.
Open tool Network troubleshootingOpen Port Checker
Check from the internet whether ports are open, closed or filtered on a server or router – port forwarding, firewalls, mail, RDP, SSH and VPN in one test.
Open tool