Enter a domain to inspect its SSL/TLS certificate.
This tool connects to a domain over HTTPS and reports the TLS certificate it presents: who issued it, which names it covers, when it expires and what the chain looks like. It is the quickest way to confirm a certificate is installed correctly and to catch one that is about to run out.
Enter a domain above to inspect its certificate.
A certificate carries more than an expiry date. The fields that usually matter when something is wrong:
It expired. Certificate lifetimes have been getting shorter, and anything not renewed automatically will eventually be missed. If you renew by hand, put the date in a calendar rather than relying on the issuer's reminder email.
The name doesn't match. A certificate for example.com does not cover www.example.com unless that name is listed too. A single-level wildcard such as *.example.com covers www.example.com but not a.b.example.com, and does not cover the bare domain.
The chain is incomplete. This is the one that produces the most confusing reports, because it is inconsistent: the server is not sending its intermediate certificates, and clients that happen to have cached them work fine while others fail. If a site loads in your browser but fails in curl or on a phone, an incomplete chain is the first thing to check.
No. The encryption strength of a connection comes from the TLS version and cipher suite negotiated between client and server, not from the price of the certificate. A free automatically-renewed certificate and a costly extended-validation one produce the same encryption.
What you pay for is the level of identity checking the authority performed, plus support and warranty terms. Domain validation proves control of the domain; organisation and extended validation involve checks on the legal entity. Since browsers stopped displaying company names in the address bar, the visible difference to an ordinary visitor is essentially nil.
Enter the domain in the tool above and read the "valid to" date. That is the moment browsers stop accepting the certificate, so renewal needs to be complete and installed before it, not on the day.
Usually an incomplete chain. If the server does not send its intermediate certificates, clients that already cached them succeed while everything else fails. Installing the full chain your certificate authority supplied fixes it.
TLS is the protocol actually in use; SSL is its predecessor and all its versions are obsolete and insecure. The name "SSL certificate" stuck for commercial reasons, but the certificate itself is simply an X.509 certificate used by TLS.
No. A wildcard such as *.example.com covers one level — www.example.com and api.example.com — but not a.b.example.com, and not the bare example.com unless that name is listed separately.
Not in terms of encryption, which depends on the TLS version and cipher suite rather than the certificate's price. Paid certificates differ in the identity validation performed by the issuer and in support and warranty terms.