Check an SSL certificate before it becomes an outage

The SSL Checker connects to the public HTTPS service on port 443 using the hostname you enter. It verifies the certificate presented for that hostname and returns the fields most useful during certificate renewal, migration and HTTPS troubleshooting.

Validity and expiry

See whether the certificate is currently within its validity window, when it started, when it expires and the calculated number of days remaining.

Hostname coverage

Review the certificate subject and Subject Alternative Names (SANs) to confirm the expected hostname is covered by the certificate presented by the server.

Issuer and signature

Identify the certificate issuer and signature type. These fields help confirm which certificate authority and certificate instance the endpoint is actually serving.

Resolved endpoint

The result includes the public IP used for the TLS connection plus connection timing, which is useful when a domain has recently moved between servers or providers.

How to read the SSL Checker result

Status shows whether the certificate is currently within its valid date range after the TLS connection and hostname verification succeed. Expires and Days remaining are the fields to watch for renewal risk. Subject Alternative Names list the DNS names included in the certificate, while IP shows the public address used for this check.

If the tool cannot establish a verified TLS connection, the endpoint may be unreachable, the certificate may be expired or invalid for the hostname, the server may be presenting the wrong certificate, or another TLS configuration problem may be preventing verification.

Common reasons an SSL certificate check fails

Expired certificate

The certificate passed its validity end date and has not been renewed or the renewed certificate has not been deployed to the public server.

Hostname mismatch

The server presents a certificate that does not cover the hostname being requested. This often appears after DNS changes, reverse-proxy changes or incorrect virtual-host configuration.

Wrong certificate after migration

A new server, load balancer or CDN may still be serving a default or previous certificate even though DNS already points traffic to the new infrastructure.

Connection or SNI problem

Modern shared HTTPS hosting relies on SNI to select the correct certificate. A broken listener, firewall rule or TLS virtual-host mapping can stop a verified connection from completing.

When to use this tool

Run a check after issuing or renewing a certificate, changing DNS, moving a site to a new host, putting a CDN or load balancer in front of a site, or investigating browser certificate warnings. It is also useful as a manual confirmation alongside automated expiry monitoring.

What this SSL Checker does not test

This page is a certificate-focused diagnostic. It does not perform a complete TLS security audit, grade protocol versions or cipher suites, test every certificate-chain edge case, or simulate every browser and operating system. A valid certificate also does not prove that the application behind HTTPS is healthy.

SSL troubleshooting guides

Related website tools

SSL certificate troubleshooting checklist

Start with the hostname users actually visit. Confirm DNS points to the intended infrastructure, check that the public endpoint presents the expected certificate, verify the hostname is included in the certificate SANs, and confirm the expiry date is safely in the future. If a renewal recently completed, make sure the renewed certificate was deployed to every load balancer, proxy or origin that can receive traffic.

Frequently asked questions

What does “days remaining” mean?

It is the approximate number of full days between the current check and the certificate's expiration timestamp. Treat it as an operational reminder rather than waiting until the final day to renew.

Can a certificate be valid but still show a browser warning?

Yes. Browser warnings can also involve hostname mismatch, trust-chain problems, mixed content, local clock issues, interception software or a different endpoint receiving the browser's request.

Why does the certificate look different after a DNS change?

The hostname may now resolve to different infrastructure. If the new endpoint has not been configured with the intended certificate, it can present a default or older certificate instead.

Does this check renew an SSL certificate?

No. The checker is read-only. It connects to the public endpoint and reports the certificate that the server currently presents.