SSL Certificate Checker

The SSL Certificate Checker connects to a website the same way a browser does and reads its certificate. You see whether it is trusted, who issued it, which names it covers, when it expires and how many days are left. Use it after setting up a new site, before a certificate expires, or when a browser shows a security warning.

What an SSL certificate does

An SSL certificate (today technically TLS, but everyone still says SSL) does two jobs. It encrypts the connection between a visitor and the website, so passwords, forms and payment details cannot be read on the way. And it proves the site’s identity, so a visitor knows they are talking to the real example.com and not an impostor.

When a certificate is valid, browsers show the padlock and load the site with https. When it is missing, expired or wrong, browsers show a full-page warning that scares most visitors away. Search engines also prefer secure sites, and many modern browser features only work over https.

How to use the checker

1. Type the domain, like example.com or shop.example.com. You can paste a full https address; the tool uses only the host name.

2. Press Check SSL. The tool connects on port 443 and reads the certificate the server sends.

3. Read the verdict. Valid certificate, Expires soon, Expired or Not trusted, with the days left in large type.

4. Review the details. Issued to, issued by, valid from, valid until and the server IP.

5. Check the covered names. The list shows every domain name the certificate is valid for.

The verdicts explained

Understanding every detail

Issued to

The main name on the certificate (the common name). Modern certificates rely more on the covered names list, but this is usually the main domain.

Issued by

The certificate authority that signed it. Common free authorities are Let’s Encrypt, ZeroSSL and Google Trust Services. Cloudflare and many hosts issue certificates automatically from one of these. Paid certificates come from companies like DigiCert or Sectigo.

Valid from and valid until

The certificate only works between these dates. Free certificates are short lived, often about 90 days, and renew automatically. Paid certificates used to last longer, but industry rules keep shortening the maximum lifetime, so automatic renewal is now the normal way to manage certificates.

Names covered

The list of host names the certificate is valid for. A certificate for example.com does not automatically cover www.example.com or shop.example.com. A wildcard entry like *.example.com covers one level of subdomains but not the root domain itself unless that is listed too.

Common SSL problems and fixes

“Your connection is not private” on the www version only

The certificate covers example.com but not www.example.com. Reissue the certificate with both names, which most hosts do automatically if the www record points to the same server. Check the www record with the DNS Records Checker.

The certificate expired even though it was free and automatic

Auto-renewal usually fails because the domain no longer points to the server that issued it, for example after a DNS change, or because a CAA record blocks the authority. Fix the DNS, then reissue from your hosting dashboard.

The checker says Not trusted, but my browser shows the padlock

Your browser may have cached the missing intermediate certificate from another site. Other devices may still fail. Install the full chain file from your certificate provider.

Mixed content warnings

The certificate is fine, but the page loads images or scripts over plain http. Browsers then show a broken padlock. Update links in your site to https. In WordPress, set both the WordPress Address and Site Address to https in Settings.

A new site shows a certificate for another domain

On shared hosting, a server may present a default certificate before yours is issued. Wait for the free certificate to be issued after the domain points to the host, then check again.

What happens when a browser opens an https site

It helps to know the steps, because each one can fail in its own way:

1. DNS lookup. The browser finds the server’s IP address. If DNS points to the wrong server, the browser receives the wrong certificate.

2. Connection with SNI. The browser connects on port 443 and says which name it wants. Shared servers host many sites on one IP, so this name decides which certificate the server sends.

3. Certificate check. The browser checks that the certificate covers the name, is within its dates, and is signed by an authority it trusts through a chain of intermediate certificates.

4. Key exchange. Browser and server agree on secret keys that only they know.

5. Encrypted traffic. Everything after this point, including the page, cookies and form data, travels encrypted.

If step three fails, the visitor sees a warning page. That is the step this checker focuses on.

Types of certificates

The free certificates most hosts provide are domain validated. They can include several names, and some providers also issue free wildcards.

Free vs paid certificates

For almost every website, a free certificate is enough. The encryption is exactly the same strength. Paid certificates can include organisation validation, where the authority checks that a registered company exists, and sometimes warranties. Browsers no longer show special green company names for those certificates, so the visible difference to visitors is very small. Unless a bank, payment provider or client contract requires a paid certificate, use the free one your host provides.

SSL checklist for site owners

1. Cover both versions. The certificate should include the root domain and www.

2. Force https. Redirect every http request to https. The Website Status Checker shows the redirect steps.

3. Fix mixed content. Make sure images, scripts and fonts load over https.

4. Watch the expiry date. Check here once a month, or whenever you change DNS or hosting.

5. Keep auto-renew working. Do not move DNS away from the server that renews the certificate without setting up renewal on the new server first.

Should you worry about a phishing site with a padlock?

Yes, a little. The padlock only means the connection is encrypted and the certificate matches the name in the address bar. It does not mean the business is honest. Scam sites can get free certificates as easily as anyone else. Before trusting a site with money or passwords, also check the exact spelling of the domain, its age with the Domain Age Checker and its registration record with the WHOIS Lookup.

How this checker tests your site

The tool resolves the domain, refuses private or local addresses for safety, then opens a TLS connection on port 443 with the domain name sent as SNI, just as a browser does. It first reads the certificate without verification to show you its details even if it is broken, then makes a second, fully verified connection to decide whether browsers would trust it. Results are cached for an hour, so if you just fixed a certificate, wait a little before checking again.

Frequently asked questions