SSL / TLS Certificate Checker
Inspect a site's TLS certificate: issuer, validity window, TLS version and the domains it covers (SANs).
How to read the result
- Issuer
- The certificate authority that signed the certificate. For most sites this is Let's Encrypt or another automated CA, which says nothing about quality — an automated certificate encrypts exactly as well as a paid one.
- Valid from / to
- The window the certificate is trusted in. Short windows are normal now: automated issuance has pushed typical lifetimes down to 90 days and shorter, so a near expiry date is expected rather than alarming.
- Subject alternative names
- Every hostname the certificate covers. This is the field to check when one form of the address works and another throws a warning — a certificate listing only
www.example.comis not valid forexample.com. - TLS version
- The protocol version negotiated with us. TLS 1.2 and 1.3 are current; anything older is a finding.
Where this tool is wrong
Every check here reads one signal, and each has a blind spot worth knowing before you act on the answer.
- We report the certificate served to us for the hostname you entered. A server can present a different certificate to a different hostname on the same address, and a CDN serves its own certificate at the edge rather than the origin's.
- This reads the certificate itself. It does not walk the full chain of trust, so a certificate that is valid here can still fail in a browser because an intermediate certificate is missing from the server's configuration — a common and easily missed misconfiguration.
- Revocation is not checked. A certificate that was revoked early still reports its original validity window.
Common questions
The certificate looks valid here but my browser warns about it.
The most likely cause is an incomplete chain: the server sends its own certificate but not the intermediate that links it to a trusted root. Browsers often paper over this by fetching the missing piece themselves, so the problem shows up on some clients and not others.
Why is my certificate only valid for 90 days?
Because it is issued automatically and renewed automatically. Short lifetimes limit the damage a stolen key can do, and the industry is moving shorter still. The thing to verify is that renewal is automated, not that the window is long.
Does www work but the bare domain does not?
Check the subject alternative names above. If only one of the two is listed, the other has no valid certificate and browsers will refuse it regardless of what the server does.
Do I need to buy a certificate, or is a free one fine?
A free automated certificate provides exactly the same encryption. Paid certificates differ in warranty, support and the organisation-validated variants that show company details — none of which affects how securely the connection is encrypted.