Skip to main content
HostTracker
HostTracker
website monitoring service
Status pages Instant check Price
Login Register

SSL certificate checker

Free SSL checker for any website. Test your certificate's expiry date, issuer, chain of trust, and TLS version and cipher, as seen from 300+ locations around the world

Examples: 300+ locations worldwide · results in about 10 seconds

You've used today's free checks

Create a free account to keep checking. It takes less than a minute, and new free checks are available again tomorrow.

Start 30-day free trial Already have an account? Log in
{{error.message}}

Unlock the full report

30-day free trial · cancel anytime

Loading plans…
See all plans & pricing
Recommended
{{ plan.name }}
{{ money(priceMo(plan)) }}/mo
  • {{ plan.maxTaskCount == null ? 'Unlimited' : plan.maxTaskCount }} monitored sites
  • All check locations in the report
  • TLS, headers & timing details
  • Scheduled reports
  • REST API access
Start the 30-day trial
Billed only after your trial · Compare all plans

What our SSL checker tests

We check your certificate's expiry date, issuer, subject and alternative names, chain of trust, and the negotiated TLS protocol and cipher.

Find out more

Why checking from many locations matters

A CDN, load balancer or reverse proxy can serve a different certificate to different regions, so a single-location check can miss a problem your other visitors are already seeing.

Find out more

A check tells you today. Monitoring tells you before it's a problem

This is a one-time result. Set up SSL certificate monitoring to get alerted automatically 30, 7 and 1 day before your certificate expires.

Find out more

A one-time check only tells you today's status Set up SSL certificate monitoring

Key takeaways

  • This tool makes an HTTPS request to the host you enter with strict TLS (Transport Layer Security) validation and reports the certificate's expiry date, its issuer, its chain, the protocol version and the cipher in use.
  • Strict validation means an expired certificate, an untrusted or self-signed chain or a hostname mismatch is reported rather than tolerated, which is what a browser will do to your visitors.
  • The check runs from more than 300 HostTracker locations, so a certificate served correctly by one edge node and wrongly by another is visible.
  • It is free, needs no login and no credit card.
  • For continuous checks, see the SSL certificate monitoring page, which warns 30 days, 7 days and 1 day before expiry.

Frequently asked questions.

Enter the address starting with https:// and run the check. A Valid verdict means that at every location that connected, the certificate had not expired, chained to a trusted root and matched the hostname, and the connection used TLS 1.2 or newer. An amber or red "Expires in N days" is still a valid certificate, just one that needs renewing.
An expired certificate; one that expires soon (amber at 30 days or fewer, red at 7 or fewer); a self-signed certificate or one from a private CA; a hostname the certificate does not cover; an outdated protocol such as TLS 1.0 or 1.1, which RFC 8996 deprecates; a different certificate in some regions; and locations that could not complete the handshake at all. For the last one, test port 443 with the port checker and read SSL handshake failed.
A certificate is a file on a server, and a busy site has many servers: a CDN keeps a copy on every edge, a load balancer has several nodes and GeoDNS can send each region to a different origin. A renewal that reaches most of them but not all leaves some visitors with an old certificate while your own browser shows a fresh one. This check runs the same handshake from many checkpoints at once and tells you when the answers differ.
Renew it, then reload the web server, load balancer or CDN so it actually serves the new file - an issued but unloaded certificate is a common cause. Run the check again to confirm every location sees the new expiry date. The expired certificate error guide covers the browser side.
The certificate does not list the name you checked among its subject alternative names - for example it covers www.example.com but not example.com, or the server hands out its default certificate for this name. Reissue the certificate with every hostname you serve and check the virtual host settings. See the "connection is not private" guide.
Run openssl s_client -connect example.com:443 -servername example.com -brief < /dev/null. It prints the protocol, the cipher suite, the certificate and a verification result. The -servername option sends the hostname during the handshake (SNI), so a server that hosts several sites returns the right certificate. It shows the answer from one network only; the guide to checking certificate expiry has the command for the exact dates.
Most often the server is not sending its intermediate certificate. Like most browsers, this check downloads a missing intermediate from the address written inside the certificate and completes the chain, so the verdict stays Valid. OpenSSL, many API clients and some older devices do not do that, so it is still worth installing the full chain on the server.
No. It validates the chain, the hostname and the dates, but it does not ask the certificate authority's OCSP or CRL service whether the certificate was revoked. The certificate decoder lists the OCSP and CRL addresses a certificate carries if you want to query them yourself. SSL certificate monitoring does ask the authority's OCSP or CRL service on every run, and alerts you when a certificate is revoked.
Yes. Put the port in the address, for example https://example.com:8443. The check opens an HTTPS connection, so it reads the certificate of a service that starts with a TLS handshake. A mail server that upgrades with STARTTLS on port 25 or 587 does not present its certificate this way.
Set up SSL and domain expiration monitoring. It checks the certificate on a schedule and sends a reminder 30, 7 and 1 day before expiry by email, SMS, Slack, Telegram and more, plus an immediate alert when the certificate turns invalid. The guide to how to monitor SSL certificate expiration walks through the setup.

Part of HostTracker's website monitoring software.