How to use
Enter the domain
Type a hostname such as example.com or shop.example.com, or paste a full URL. Each subdomain can have its own certificate, so check the exact name your visitors use.
Press Check
The tool opens a TLS connection on port 443, reads the certificate, and checks CAA and HSTS alongside it. If the handshake fails, you get a plain-English diagnosis in place of the details.
Read the expiry and details
Check the banner and the checklist, then load the SAN list from CT logs. Add a renewal reminder (.ics), copy any field, or switch to Bulk to check many domains at once.
Why SSL Certificate Checker
- Reads the certificate your server actually sends, over a live TLS connection on port 443.
- Issuer, subject, dates, days until expiry, TLS version and SHA-1 fingerprint, plus CAA and HSTS checks.
- Loads the certificate's SAN list and recent certificates from public Certificate Transparency logs.
- Bulk mode checks up to 20 domains and sorts them by expiry. Add a renewal reminder to your calendar.
Common SSL errors and how to fix them
When the connection fails, the checker names the error in plain English. These are the ones you will meet most often, with the usual fix. After fixing any of them, reload or restart the web server so it picks up the new files, then run the check again.
| Error | What it means | Usual fix |
|---|---|---|
| Certificate has expired | The valid to date has passed | Renew the certificate and fix the auto-renew job |
| Name mismatch | The certificate does not cover this hostname | Reissue it with every name you use, including www |
| Missing intermediate | The server sends its certificate without the chain | Install the full chain or bundle file from your provider |
| Self-signed certificate | Not issued by a trusted authority | Replace it with a certificate from a public CA |
| Not yet valid | The start date is in the future | Check the server clock or wait for the start date |
| No TLS on port 443 | Nothing answered with HTTPS | Enable HTTPS on the server and open port 443 in the firewall |
CAA records and Certificate Transparency
A CAA record in DNS lists the certificate authorities allowed to issue certificates for your domain. If it exists and does not include the CA you use, your next renewal will be refused. The checker reads CAA for the name and its parents and warns when the current issuer does not seem to be listed.
Certificate Transparency logs are public records of every certificate a trusted CA issues. They let you see all the names a certificate covers and spot certificates you did not order. Checking them now and then is a cheap way to catch a mis-issued certificate for your domain.