🔒
SSL Certificate Checker
Look up the SSL/TLS certificate of any domain online: validity, issuer, full chain, trust status and cipher suite. Free, no sign-up.
Examples:
The check performs a real TLS handshake from our server node, so results reflect the server's point of view rather than your browser's.
Enter a domain and click Check to inspect its SSL certificate.
# SSL Certificate Checker
Enter a domain to inspect the SSL/TLS certificate it currently serves: validity period, issuer, the complete certificate chain, system trust validation, and the TLS protocol and cipher suite used for the handshake.
## Features
- Validity dates and days remaining, highlighted when the certificate expires within 30 days
- Issuer and subject details (CN / O / OU / C)
- Full certificate chain with subject, issuer, validity and fingerprints for every level
- Trust validation against the system CA store, calling out expired, self-signed and hostname-mismatched certificates
- Certificate extensions: SAN entries, Key Usage, Extended Key Usage, OCSP and CRL URLs
- Handshake details: TLS version, cipher suite and ALPN (HTTP/2 support)
- Custom ports supported, for example `example.com:8443`
- One-click JSON copy plus PEM downloads for the leaf certificate or the full chain
## Usage
1. Enter a domain such as `example.com`, optionally with a port: `example.com:8443`
2. Click Check and wait a few seconds (20 seconds maximum)
3. Review the certificate fields, the chain and the trust result
4. Copy the JSON or download the PEM files when you need to keep the result
## Reading the results
- **Expired**: the certificate's expiry date is in the past, browsers will warn visitors and it needs renewal
- **Untrusted**: usually a self-signed certificate, a missing intermediate, or an issuer outside the system trust store
- **Hostname mismatch**: the SAN list of the certificate does not contain the domain you queried
- **Connection failed**: the port is closed or does not serve HTTPS
## Security and privacy
- The check performs a real TLS handshake from the server, so results reflect the server's network viewpoint and may differ from your browser
- Domains that resolve to internal or reserved addresses are rejected for safety
- Checks are limited to 30 per minute per source
- Queries are not stored