SSL certificate checker for expiry, chain trust, and issuer validation

Verify TLS certificate status before users see browser warnings. This checker surfaces expiration timing, chain issues, and issuer details so teams can remediate quickly.

After certificate renewals, use DNS Lookup and DNS Propagation Check to confirm DNS and endpoint alignment.

How to read the certificate report

Chain: a browser trusts your certificate only if it can walk from the leaf certificate through one or more intermediates to a root it already knows. A missing intermediate is the classic silent failure: the site works in Chrome, which fetches missing intermediates on its own, but fails in curl, older Android, and many API clients. If the chain section shows only the leaf, fix the server's certificate bundle.

Expiry: check the "valid to" date, not just today's status. Let's Encrypt certificates last 90 days and depend on automated renewal, so an expiry closer than 30 days often means the renewal job is broken. Publicly trusted certificates cannot exceed 398 days, so anything "valid for 5 years" is private or self-signed.

Names (SAN): the certificate must list the exact hostname being visited in its Subject Alternative Names. A certificate for example.com does not cover www.example.com unless both are listed, and a wildcard like *.example.com covers one label only, so it matches app.example.com but not api.app.example.com. Name mismatch produces the same scary browser warning as an expired certificate.

Quick FAQ

Does this detect impending expiry? Yes, it highlights validity windows so you can renew before service impact.

I renewed, so why does the old certificate still show? The new file exists but the web server never reloaded it. Reload or restart the service, then re-run the check.

Why do I get a different certificate than my browser shows? Servers that host several sites on one IP pick the certificate by the SNI hostname the client sends. A client that omits SNI receives the server's default certificate, which often belongs to a different site entirely.

Can DNS misconfiguration affect SSL health? Yes, incorrect A/AAAA/CNAME targets can route traffic to hosts with mismatched certificates.

Seeing "Not Secure" right after moving hosts? That exact failure mode is covered step by step in SSL certificate shows Not Secure after a DNS move.