Free tool · Network & server
SSL certificate checker
Check a website’s TLS certificate: expiry date and days left, the host names it covers, whether the chain is trusted, the issuer, the TLS version and cipher, and the key.
SSL Certificate Checker
What it checks
The certificate browsers actually receive
The checker opens a TLS connection to port 443 with the host name you enter, the same way a browser does, and reads the certificate and chain the server presents. It first verifies the connection against the standard certificate authority bundle; if that fails, it reconnects without verification so it can still show you what is wrong.
Validity
Valid-from and expiry dates, days left, and the certificate’s total lifetime. Under 30 days is a warning and under 14 days is critical.
Host names
The Subject Alternative Names the certificate covers, including wildcards, and whether the host you entered is one of them.
Trust chain
Whether browsers will trust the certificate, the intermediate certificates the server sends, and the likely reason when verification fails: expired, wrong host, self-signed, or a missing intermediate.
Connection and key
The TLS version and cipher negotiated, the key type and size, and the signature algorithm, with warnings for TLS 1.0 and 1.1, RSA keys under 2048 bits and SHA-1 signatures.
Why it matters
Certificate lifetimes are getting shorter
An expired or mismatched certificate replaces your website with a full-page browser warning. Most visitors leave, online payments stop, and APIs and apps that connect to the site fail. It is one of the most common causes of avoidable downtime.
Renewal is also becoming more frequent. Since March 2026, publicly trusted certificates can be valid for at most 200 days; the limit falls to 100 days in March 2027 and to 47 days in March 2029. Manual renewal once a year no longer works, so automated renewal through ACME clients such as Certbot, your hosting panel or your CDN is effectively required.
A missing intermediate certificate is the other classic problem: the site works in some browsers that cached the intermediate, and fails in others, in command-line tools and in API clients.
Questions
About SSL certificates
For a full pre-launch check including the certificate, HTTP to HTTPS redirects and HSTS, use the Website Launch Checker.
How do I fix a missing intermediate certificate?
Install the full chain your certificate authority provides (often a file named fullchain.pem or a CA bundle) instead of the certificate alone, then reload the web server.
My site uses Cloudflare. Which certificate does this show?
The one visitors see at the edge, issued for Cloudflare’s connection to browsers. The certificate on your origin server, used between Cloudflare and your host, is separate and should also be valid when SSL mode is Full (strict).
Does the www address need its own certificate?
It needs to be covered, either as a separate name on the same certificate or by a wildcard. Check both variants if visitors can reach both.
Can it check other ports or mail servers?
No. For safety it connects only to port 443 on public addresses.
This tool came from ToolsPing?
Yes. It is based on ToolsPing’s SSL checker, rebuilt for HUB with chain trust, host name matching and connection details.
Need help with what
the tools found?
HUB engineers implement technical SEO, performance, security and AI-readiness fixes on WordPress, Magento, custom PHP and modern JavaScript stacks.