Theme

Popular tools

SSL Checker

Check any site's SSL certificate online: valid or not, the expiry date, the chain of trust in every browser, revocation, TLS versions and ciphers. Graded A+ to F in seconds, for websites and mail servers.

Sources: a live TLS handshake · four root stores (CCADB) · OCSP or CRL · Certificate Transparency logs · hstspreload.org

Try

What this SSL checker tests

An SSL checker connects to a server the way a browser does and reads the certificate it presents. This one speaks TLS itself, so it sees exactly what the server sends: the certificate and its chain, the protocol version, the cipher suite and the key exchange. Sites behind Cloudflare refuse our connection, so for them the certificate comes from the CT log and the protocol scan and grade are skipped; IPv6-only servers can't be reached yet. Then it checks the chain against the four root stores browsers and operating systems use, asks the CA whether the certificate was revoked, and scans which older protocols and weak ciphers the server still accepts.

The result works as an SSL test, an HTTPS checker and a TLS checker in one: a verdict in plain words, an A+ to F grade with its reasons, and the details behind it. It also checks what sits around the certificate: the HSTS header, the HTTP to HTTPS redirect, CAA records and the Certificate Transparency log.

SSL checker result for github.com: valid certificate, A+ grade, lifetime ruler and the chain of trust to four root storesSSL checker result for github.com: valid certificate, A+ grade, lifetime ruler and the chain of trust to four root storesThe verdictValid or not in one sentence, the days left, the issuer, and the grade with its reasons.The lifetimeWhere the certificate is in its life: issued, today, expiry, against the maximum for its issue date.The chain of trustEvery certificate from the site to the root, how we got each one, and the four root stores' verdicts.The checksHostname, chain, trust, revocation, protocols, key exchange, HSTS and CAA, each with a fix when it fails.
A check of github.com: the verdict and grade, the certificate's lifetime, the checks, and the chain of trust down to the browsers' root stores. Select a number to see what each part shows.

How to check an SSL certificate

Three ways, from the quickest to the most detailed:

  1. 1

    With this SSL certificate checker

    Type the domain (or a URL, or host:port for another service) and select Check SSL. The certificate and its chain arrive first, then revocation, the protocol scan and HSTS fill in, and the verdict and grade come last.

  2. 2

    In the browser

    Select the icon to the left of the address, then Connection is secure and Certificate is valid (Chrome) or More information (Firefox). You see the names, the issuer and the dates, but not the chain as the server sent it, the protocols it allows, or whether it was revoked: Chrome doesn't check most revocations online.

  3. 3

    With openssl

    openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null prints the chain the server sends; pipe it to openssl x509 -noout -dates for the expiry date. The commands are below and in the result's Chain view.

How to check when an SSL certificate expires

Check the domain above: the result says how many days are left and shows the certificate's whole lifetime, from the day it was issued to the day it expires. The Valid to date is the certificate's notAfter field; after that moment every browser shows a full-page warning (NET::ERR_CERT_DATE_INVALID in Chrome).

From a terminal, echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate prints the same date, and -checkend 2592000 tells a script whether it expires within 30 days. The History view can download a calendar reminder for any date before expiry, without an account. If you only have the certificate file, paste it into the certificate decoder to read its dates and every other field without connecting to the server.

Let's Encrypt stopped sending expiry emails in June 2025, and certificates are getting shorter, so renewals should be automatic: renew at about two-thirds of the lifetime (60 days into a 90-day certificate), or let the CA say when through ACME Renewal Information (RFC 9773).

Certificate lifetime · example-shop.com

Issued Sep 1, 2026 · 90 daysrenew by Oct 31, 2026200-day maximum
Today · day 51 of 90Expires Nov 30, 2026Today · day 51 of 90 · Expires Nov 30, 2026
openssl x509 -enddate
$ echo | openssl s_client -connect example-shop.com:443 -servername example-shop.com 2>/dev/null | openssl x509 -noout -enddate
notAfter=Nov 30 07:11:59 2026 GMT
$ echo | openssl s_client -connect example-shop.com:443 -servername example-shop.com 2>/dev/null | openssl x509 -noout -checkend 2592000
Certificate will not expire

Why are SSL certificates getting shorter?

Because browsers and CAs voted for it. CA/Browser Forum ballot SC-081 (April 2025) cuts the longest a public TLS certificate may be valid in three steps, so a leaked key or an out-of-date identity stops working sooner:

Validations shrink with them: a CA may reuse a completed domain validation for 200 days now, 100 days from 2027 and only 10 days from March 2029, so the domain is proved again almost every time.

Let's Encrypt goes further on its own schedule: its 90-day certificates become 64-day certificates on 10 February 2027 and 45-day certificates on 16 February 2028, and six-day certificates are available today. A certificate this checker shows as longer than the maximum for its issue date breaks the rules (Chrome rejects it).

  1. Since 2020398 days
  2. 15 March 2026200 days
  3. 15 March 2027100 days
  4. 15 March 202947 days

Manual renewal once a year stopped working on 15 March 2026. Use an ACME client (Certbot, Caddy, your host's AutoSSL) and check that renewals actually happen.

SSL chain checker: leaf, intermediate and root

A browser trusts a site's certificate because a chain of signatures leads from it to a root certificate in its root store. The server must send its own certificate and the intermediates; the root is already on the device. This chain checker shows the chain twice: as the server sent it, and as browsers build it, with the root each store trusts.

The most common mistake is a missing intermediate: the server sends only its own certificate. Chrome can usually fetch the missing one from the address in the certificate (AIA), and Firefox preloads the intermediates CAs disclose to the CCADB, so the site looks fine in a browser. Apps, API clients, curl and other tools often don't, and fail with errors such as unable to get local issuer certificate.

Leaf (the site's certificate)
Names the site in its Subject Alternative Names and holds the server's public key. Valid for 200 days at most if issued since 15 March 2026.
Intermediate
Signed by the root and signs the site's certificate, so the root's key can stay offline. The server must send it.
Root
Self-signed and trusted because the browser or operating system ships it in its root store. Sending it is allowed but useless.

Fix an incomplete chain

  1. 1

    Install the full chain file your CA gave you (often called fullchain.pem or ca-bundle), not the certificate alone. The result's Chain view can download the right bundle.

  2. 2

    nginx: ssl_certificate must point to the certificate followed by the intermediates in one file.

  3. 3

    Apache 2.4.8+: put the intermediates in the SSLCertificateFile after the certificate (older versions use SSLCertificateChainFile).

  4. 4

    Check again: the chain should end at a root in all four stores with no certificate marked fetched by us.

Chain of trust

  1. Site certificateexample-shop.comLet's Encrypt · DV · RSA 2048sent by the server
  2. IntermediateR13RSA 2048 · until Mar 2027sent by the server
  3. RootISRG Root X1until Jun 2035from the root stores
  4. Root storesTrusted everywhere

Common SSL certificate errors and how to fix them

What the browser's warning means, and what the checker shows for it:

  • NET::ERR_CERT_DATE_INVALID

    SEC_ERROR_EXPIRED_CERTIFICATE / MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE

    The certificate has expired (or isn't valid yet), or the device's clock is wrong.

    Renew it and install the new certificate, then make renewal automatic. The checker's lifetime ruler shows the dates.

  • NET::ERR_CERT_AUTHORITY_INVALID

    SEC_ERROR_UNKNOWN_ISSUER / MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT

    The chain doesn't lead to a trusted root: a self-signed or private-CA certificate, or a missing intermediate.

    Install a certificate from a public CA with its full chain. The chain of trust shows where it breaks.

  • NET::ERR_CERT_COMMON_NAME_INVALID

    SSL_ERROR_BAD_CERT_DOMAIN

    The certificate doesn't name the site you opened. A wildcard covers only one level: *.example.com is not example.com or a.b.example.com.

    Issue a certificate that lists every name the site answers on, www included.

  • ERR_SSL_VERSION_OR_CIPHER_MISMATCH

    SSL_ERROR_NO_CYPHER_OVERLAP / SSL_ERROR_UNSUPPORTED_VERSION

    The browser and the server share no protocol version or cipher suite, usually a server that offers only TLS 1.0 or old ciphers.

    Enable TLS 1.2 and TLS 1.3 with AEAD ciphers. The Protocols view lists what the server accepts.

Which TLS versions should a server support?

TLS 1.3 and TLS 1.2, nothing older. TLS 1.0 and 1.1 have been formally deprecated since March 2021 (RFC 8996) and every current browser refuses them; SSL 3.0 is broken. TLS 1.3, now RFC 9846, is faster (one round trip) and keeps only AEAD ciphers with forward secrecy.

The key exchange is the part to watch next. Chrome, Firefox and Apple's systems now offer X25519MLKEM768, a hybrid of X25519 and the post-quantum ML-KEM (FIPS 203), standardised for TLS in RFC 10024, so traffic recorded today can't be decrypted by a future quantum computer. More than half of human traffic through Cloudflare used it by late 2025, but few origin servers accept it yet. The Protocols view shows whether yours does.

How the SSL grade works

The grade is modelled on Qualys SSL Labs' rating guide: a problem a browser shows as an error decides the letter first, then each weaker setting caps the best letter possible.

GradeWhat it takes
A+A clean A, TLS 1.3, and HSTS kept at least six months.
ATrusted, TLS 1.2 and 1.3 only, forward secrecy and AEAD ciphers. Mail servers top out here (HSTS is for websites).
A-No TLS 1.3, or a website without a valid HSTS header.
BTLS 1.0, TLS 1.1 or RC4 still accepted, a key below 2048 bits, no forward secrecy or AEAD, or an incomplete chain.
CSSL 3.0 on, 3DES or RC4 still chosen for modern clients, or neither TLS 1.2 nor 1.3.
FExpired, revoked, export-grade ciphers, RC4 only, or SSL 3.0 as the best protocol.
T / MNot trusted (T) or issued for another name (M): browsers show a warning whatever the setup. The letter it would earn once fixed is shown too.

HSTS, CAA, OCSP and the rest of the setup

  • HSTS

    The Strict-Transport-Security header tells browsers to use only HTTPS for max-age seconds. With a year or more, includeSubDomains and preload, a site can join the HSTS preload list built into browsers. The result reads the header and the list.

  • HTTP to HTTPS

    http:// should redirect to https:// on the same name before anything else, or the first visit stays unencrypted.

  • CAA records

    A CAA record in DNS names the CAs allowed to issue for the domain; every public CA must check it. The result shows the record and whether it allows the CA that issued the current certificate, so a renewal won't fail.

  • Revocation

    Since 2024 CRLs are required and OCSP optional, and Let's Encrypt shut its OCSP service in August 2025. A certificate without an OCSP address is normal: the checker reads the CRL instead.

Check an SSL certificate with OpenSSL

The openssl commands for the same checks, on macOS, Linux and Windows (with OpenSSL installed). Put your host in place of example.com:

To checkCommand
The chain the server sendsopenssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null
The expiry dateecho | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates
Expires within 30 days?echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -checkend 2592000
Names, issuer and keyecho | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -text
TLS 1.3 accepted?openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null
A mail server (STARTTLS)openssl s_client -connect mail.example.com:587 -starttls smtp -servername mail.example.com </dev/null

SSL checker API

A free endpoint with CORS: POST {"domain": "example.com"} to /api/ssl-certificate for the fields of our older API, now with true trust, signature and version values plus the grade, the store verdicts and revocation. 30 checks a minute per network; a repeat within ten minutes comes from cache.

POST /api/ssl-certificate
$ curl -X POST https://dnsrobot.net/api/ssl-certificate \
    -H "Content-Type: application/json" -d '{"domain": "github.com"}'
{
  "success": true, "domain": "github.com",
  "leafCertificate": { "daysToExpire": 39, "isValid": true, … },
  "trustStatus": { "isTrusted": true, "hasValidChain": true, … },
  "v2": { "state": "valid", "grade": "A+",
          "stores": { "mozilla": true, "chrome": true, … }, … }
}

SSL Checker FAQ

How do I check if a website's SSL certificate is valid?

Type the domain into the SSL checker above. A certificate is valid when it is within its dates, names the site you checked, chains to a root every major browser trusts and hasn't been revoked. The result checks all four and says which one fails, with the fix. In a browser, the padlock's certificate viewer shows the names and dates, but not the chain the server sends or revocation.

How do I check when an SSL certificate expires?

Check the domain above: the result shows the expiry date, the days left and the whole lifetime on a ruler. From a terminal, openssl x509 -noout -enddate on the server's certificate prints the date. Public certificates issued since 15 March 2026 last at most 200 days, so renewal should be automatic; the History view also downloads a calendar reminder.

Can I get an alert before an SSL certificate expires?

Yes, two ways. After a check, "Remind me" in the result makes a calendar event (.ics) as many days before expiry as you choose; the file is made in your browser, with no account and nothing stored. Or choose "Watch this domain": with a free DNS Robot account, up to 3 domains are checked once a day, and you get an email 30, 14, 7 and 1 days before the certificate expires, and when it expires, becomes invalid (chain, name or revocation), is renewed or changes issuer.

What does an SSL test check?

The certificate (dates, names, key, signature, validation level), the chain and its trust in the Mozilla, Chrome, Apple and Microsoft root stores, revocation through OCSP or the CA's CRL, which protocol versions from SSL 3.0 to TLS 1.3 the server accepts, its cipher suites and key exchanges, and the HSTS header. Each problem lowers the A+ to F grade.

What is an intermediate certificate, and why is my chain incomplete?

An intermediate is the CA certificate that signs a site's certificate, signed in turn by a root. The server must send it. A chain is incomplete when the server sends only its own certificate: Chrome often fetches the missing one, so the site looks fine, but apps, curl and other clients fail. Install the full chain file from your CA.

Why does my site work in Chrome but fail in apps or other browsers?

Usually a missing intermediate. Chrome fetches it from the address in the certificate and Firefox preloads the intermediates CAs disclose to the CCADB, but mobile apps, API clients, Java and curl don't, so they reject the same site. A client that sends no server name (SNI) and gets the default certificate, or a root trusted in only some stores, gives the same split. The chain of trust shows which it is.

How long is an SSL certificate valid in 2026?

At most 200 days for a certificate issued since 15 March 2026, down from 398. The limit drops to 100 days on 15 March 2027 and to 47 days on 15 March 2029, under CA/Browser Forum ballot SC-081. Let's Encrypt issues 90-day certificates now, 64-day ones from February 2027 and 45-day ones from February 2028.

What do the SSL grades A+, A, B, T and M mean?

A+ is a trusted certificate on a server with TLS 1.3, strong ciphers and HSTS of six months or more. A is a good setup without the extras; A- lacks TLS 1.3 or, for a website, HSTS. B means TLS 1.0, TLS 1.1 or RC4 is still on, no forward-secret or AEAD cipher, or an incomplete chain; C means 3DES or RC4 still chosen for modern clients. T means untrusted, M issued for another name: browsers warn either way.

Can I check the SSL certificate of a mail server or another port?

Yes. Choose the port next to the field or type host:port: 587 for SMTP submission with STARTTLS, 465 for SMTPS, 993 and 143 for IMAP, 995 and 110 for POP3, 853 for DNS over TLS, or any other port. Port 25 can't be checked from our servers yet. Mail servers get the same certificate, chain and protocol checks, without the HSTS step.

How do I know if an SSL certificate has been revoked?

The checker asks the CA: first the OCSP response the server staples into the handshake, then the CA's OCSP responder, then its certificate revocation list (CRL). Some CAs, Let's Encrypt among them, no longer run OCSP, so the CRL is checked instead. Browsers check revocation in their own ways, so a revoked certificate isn't always blocked everywhere.

Is my website quantum-safe?

Its key exchange can be. If the server accepts X25519MLKEM768, browsers that offer it (Chrome, Firefox, Safari on Apple's 2025 systems) protect the session against later decryption by a quantum computer. The Protocols view shows which key exchange groups the server accepts and prefers. Certificates themselves still use classical RSA or ECDSA keys.

What is the difference between SSL and TLS?

TLS is the modern version of SSL. SSL 2.0 and 3.0 were replaced by TLS 1.0 in 1999, and today only TLS 1.2 and 1.3 are safe to use. The name SSL stuck, so "SSL certificate" and "SSL checker" mean the TLS certificate and the tool that checks it. The certificate works the same with every TLS version.

Is this SSL checker free, and do you keep what I check?

It's free, with no account; one network can run 10 full checks a minute. The check runs from our server, so the site sees our connection, not yours. A result is kept for ten minutes so repeat checks are instant, and Check again runs a fresh one. We don't log who checked what.

Missing something?Suggest a feature or a new tool

More security and DNS tools