SSL certificate checker
Check any public website’s SSL certificate: the exact expiry date and days left, who issued it, which hostnames it covers and whether the chain is trusted. Enter a hostname and the checker connects to it, reads the certificate it presents and tells you plainly whether it is valid. No account needed.
What the checker reports
| Check | What it tells you | How it is decided |
|---|---|---|
| Expiry date | When the certificate stops being valid and how many days are left. A certificate with 30 days or fewer left is flagged as expiring soon. | Read from the validity dates inside the certificate. |
| Hostname match | Whether the certificate was issued for the name you entered. | The name is compared with the names listed on the certificate. |
| Trusted chain | Whether the certificate links back to a public root authority, and why not when it does not: self-signed, missing intermediate or untrusted issuer. | Verified against the public root certificates bundled with the checker. Your own browser or system store can differ slightly. |
| Issuer and chain | Who issued the certificate and each certificate in the chain, leaf first. | Read from the certificates the server presents. |
| TLS protocol | The protocol version and cipher the connection settled on. | Reported by the handshake itself. |
The checker reads one certificate, once, from one network location. It does not check revocation, and it only connects to hosts on the public internet. The checker does not save the hostnames you check or the results.
A one-off check does not stop a lapse
Certificates renew on their own until the day the renewal quietly breaks, and the first sign is a browser warning on your own site. A checker tells you the state now. A monitor tells you when it changes, with enough days left to fix it.
How Uptimely alerts you before it expires
An SSL Certificate monitor connects to your host on a schedule and reads the same facts: days left, trust, hostname and expiry. Add a rule such as Expires In Days less than 30 and the monitor changes status and opens an incident while there is still time to renew. Alerts go out by email, SMS, phone call, Slack, Discord and browser push. See what an SSL monitor checks.
Start with the Free plan
10 monitors with no credit card and no time limit, and one monitor watches one certificate. Monitor a certificate free.
When the checker finds a problem
Each problem has its own guide: an expired certificate, a failed TLS handshake, and the Cloudflare 525 and 526 errors. The glossary entry on certificate expiry covers why certificates have a lifetime at all.
How do I check when an SSL certificate expires?
Enter the site's hostname in the checker above and press Check certificate. It connects to the server, reads the certificate it presents and prints the exact expiry date and the number of days left. You do not need access to the server or an account.
Is this SSL certificate checker free?
Yes. It needs no account and does not ask for an email address. It checks one hostname at a time, and the number of checks per minute is limited so the tool stays available to everyone.
What does a chain that is not trusted mean?
The certificate does not link back to a root certificate authority in the public trust store the checker uses. The usual causes are a self-signed certificate, a server that did not send its intermediate certificate, or a certificate from a private authority. Browsers show a warning for each of them. The result names which one applies.
Why does the checker say the hostname does not match?
A certificate lists the names it was issued for. If the hostname you entered is not among them, every browser shows a name mismatch warning even though the certificate is otherwise fine. The result lists the names the certificate does cover, so you can see whether you typed the wrong host or the server is presenting the wrong certificate.
Can I check a certificate on a port other than 443?
Yes. Add the port after the hostname, such as mail.example.com:465. The checker supports 443, 8443, 465, 993, 995, 636, which are the ports where a service starts TLS as soon as you connect: HTTPS, SMTPS, IMAPS, POP3S and LDAPS. Ports that begin unencrypted and upgrade later, such as 587, are not supported.
Does the checker look for revoked certificates?
No. It reads the certificate the server presents and checks its dates, its names and its chain of trust. It does not ask the issuer whether the certificate has been revoked, so a certificate revoked before its expiry date can still show as valid here.
Can it check a certificate on a private or internal server?
No. The checker only connects to hosts on the public internet, so internal names, private IP addresses and localhost are refused. Checking a private server needs a monitor that runs inside the same network.
How can I get an alert before my certificate expires?
Create an SSL Certificate monitor in Uptimely and add a rule such as Expires In Days, Less Than, 30. The monitor then checks the certificate on a schedule and changes status and opens an incident when it crosses that line, so your team hears about it while there is time to renew. Without the rule the monitor reads the days left but does not alert on them.