GuideHow to check an SSL certificate
- Enter the domain. Type the hostname exactly as visitors reach it —
example.com and www.example.com can present different certificates.
- Run the check. The tool connects to port 443 and reads the public certificate the server presents. Nothing about your visitors is touched.
- Read the result. Validity, issuer, expiry date and the domains covered appear at a glance.
- Use Advanced if a CDN or origin is involved. Enter an Origin IP to check the certificate on a specific server, and turn on chain verification to catch a missing intermediate.
What the results tell you
- Validity: whether the certificate is currently trusted — not expired, not yet valid, and issued by a recognized CA.
- Issuer: the Certificate Authority that signed it. A self-signed or unknown issuer is why browsers show "not trusted".
- Expiry (Not After): the date the certificate stops being trusted. Renew before this date to avoid downtime and browser warnings.
- Covered domains (SAN): the hostnames on the certificate. If the domain you entered isn't listed, browsers reject it as a name mismatch.
- Chain of trust: whether the intermediate certificate is correctly installed. A broken chain is the #1 cause of "not secure" on servers that otherwise look fine.
Why check a certificate?
Most SSL problems are invisible until a visitor hits a browser warning and leaves. Checking lets you catch three things early: a certificate that's about to expire, a domain that isn't on the certificate, and a missing intermediate that makes the certificate look untrusted on some devices but fine on others. A 10-second check now prevents a "your connection is not private" page later.
Common issues a check reveals
- Expired certificate. The most common cause of sudden site-wide browser warnings.
- Name mismatch. The certificate doesn't cover the exact hostname visitors use — often
www vs non-www.
- Incomplete chain. Works in one browser, fails in another — a classic missing-intermediate symptom.
- Weak or outdated signature. Old SHA-1 certificates are no longer trusted by modern browsers.
A broken chain is the leading cause of "not trusted" errors. If the checker flags one, inspect the full chain with our CA Chain Checker.
Frequently asked questions
Does this store my domain or any data?
No. The checker connects to port 443 and reads the public certificate the server already presents to every visitor. Nothing is stored.
Why does my certificate look valid in one browser but not another?
Almost always a missing intermediate certificate. One browser caches it, another doesn't — so the chain looks complete in one and broken in the other. Turn on chain verification to confirm.
How often should I check?
Check after every install or renewal, and set a reminder ahead of the expiry date so a lapse never surprises you. Use the SSL Expiry Reminder to automate this.
My certificate expires soon — what should I do?
Renew before the Not After date. Use the compare page to get a fresh certificate, or the SSL Wizard to find the right one for your setup.