SSL Certificate Checker

What the SSL Certificate Checker checks

An SSL certificate (strictly, a TLS certificate) proves to the browser that it is talking to your domain and lets it encrypt the connection. If the certificate has expired, was issued for a different name or cannot be trusted, visitors see a full-page warning instead of your site.

This checker opens a TLS connection to the domain you enter, the same way a browser does. It reports whether the certificate chain is valid and trusted, how many days remain until it expires, whether the certificate covers the hostname, which TLS version was negotiated, and the key type and size. It also requests the plain http:// address to confirm it redirects to HTTPS. It reports the version negotiated on that connection; it does not enumerate every protocol or cipher suite the server offers.

Why it matters

Expired certificates remain one of the most common causes of avoidable outages, and they tend to fail at the worst time: a renewal job breaks quietly and nobody notices until customers do. Certificate lifetimes are also getting shorter. Since 15 March 2026, newly issued public certificates may be valid for at most 200 days, down from 398, so manual renewal is no longer realistic for most teams.

The protocol matters too. TLS 1.0 and 1.1 are deprecated and refused by current browsers, so a server that only offers them is effectively unreachable. A missing HTTPS redirect leaves visitors who type your domain on an unencrypted page.

How to fix common problems

Automate renewal. Use an ACME client such as Certbot or your server’s built-in ACME support (Caddy, Traefik, many hosting panels), or let your CDN manage the edge certificate. Then monitor expiry independently of the renewal job, because the job itself is what usually fails.

For a hostname mismatch, reissue the certificate with every name you serve, including both example.com and www.example.com. Make sure the server sends the full chain (leaf plus intermediates); a missing intermediate works in some browsers and fails in others.

Enable TLS 1.2 and 1.3 only, for example ssl_protocols TLSv1.2 TLSv1.3; in nginx. Use ECDSA P-256 or RSA 2048-bit keys or stronger. Add a permanent redirect from HTTP to HTTPS, then HSTS. Read more in our guides to TLS certificates and TLS versions. The full PerfoMetrix audit runs these checks together with 170+ others, and members can monitor a site for certificate expiry alerts.

Questions

How long can an SSL certificate be valid?

Public certificates issued since 15 March 2026 can be valid for at most 200 days. Industry rules shorten the maximum further in the coming years, so automated renewal is the only sustainable approach.

Is a free certificate less secure than a paid one?

No. Domain-validated certificates from free CAs such as Let's Encrypt use the same encryption as paid ones. Paid products differ in validation level, support and warranties, not in the strength of the connection.

Why does my site work in one browser but not another?

The most common cause is a missing intermediate certificate. Some browsers fetch or cache the missing intermediate, others do not. Configure the server to send the full chain.

Does this test check all cipher suites?

No. It reports the certificate and the protocol negotiated on a normal connection, which is what visitors experience. A full cipher enumeration needs many extra handshakes and is outside this free check.