SSL Certificate Checker
Issuer, subject, expiry, days remaining, and self-signed detection for any domain's TLS certificate.
How the SSL certificate check works
This tool connects to the domain over HTTPS, retrieves its TLS certificate, and reads out the issuer, subject, validity window, and days remaining before expiry — the same information a browser checks silently on every HTTPS connection. It also flags self-signed certificates, which browsers won't trust by default since no public Certificate Authority vouches for them.
Checking certificate expiry regularly matters because an expired certificate breaks HTTPS access for every visitor with no warning beyond a browser error page — a common and entirely avoidable outage. For the domain's underlying DNS configuration, see the DNS Lookup tool, and for registration details like ownership and expiry of the domain name itself (distinct from the SSL certificate), see the Domain Age & WHOIS Lookup.
Frequently asked questions
- What does days_remaining going negative mean?
- The certificate has already expired — expired will also be true. Browsers will show a security warning for that domain until it's renewed.
- Does a self-signed certificate mean the site is unsafe?
- Not necessarily malicious, but it means no public Certificate Authority vouches for it — browsers will show a trust warning. Common for internal tools and local development, unusual for a public-facing production site.
- What happens if the host is unreachable?
- The check times out after 5 seconds and returns a clear error rather than hanging indefinitely.
- What does an SSL certificate do?
- An SSL/TLS certificate proves a server's identity to visiting browsers and enables encrypted HTTPS connections. It binds a public key to a domain name, signed by a Certificate Authority, so browsers can verify they're actually talking to the real site and that the connection can't be eavesdropped on.
- What is the difference between DV, OV, and EV certificates?
- DV (Domain Validated) certificates only confirm the applicant controls the domain — fast and cheap to issue, the most common type today. OV (Organization Validated) additionally verifies the requesting organization's identity. EV (Extended Validation) requires the most rigorous vetting of the organization. All three provide the same encryption strength; they differ only in the identity verification behind them.
- What happens when an SSL certificate expires?
- Browsers will show a prominent security warning and typically block or heavily discourage users from proceeding to the site, since an expired certificate can no longer be trusted to prove the site's identity — this can effectively take a site offline for visitors until the certificate is renewed.
- What is certificate chain validation?
- A certificate chain links a site's certificate up through one or more intermediate certificates to a trusted root Certificate Authority that browsers ship with built-in trust for. If any link in that chain is missing or misconfigured on the server, browsers may fail to validate the certificate even if the certificate itself is technically valid.
- What is HSTS?
- HTTP Strict Transport Security (HSTS) is a response header that tells browsers to only ever connect to a site over HTTPS, never plain HTTP, for a specified period — protecting against certain downgrade and man-in-the-middle attacks that try to intercept a connection before it upgrades to HTTPS.