How to check an SSL certificate
- Enter a hostname such as
example.com. A full URL works too; the scheme and path are stripped. For a non-standard port, append it:example.com:8443. For a mail server, usemail.example.com:587(SMTP),:143(IMAP) or:110(POP3) to check its STARTTLS certificate, or:465,:993,:995for direct TLS. - Press Check Certificate. This server opens a TLS connection to the host, with SNI set to the name you entered, and reads the certificate the server presents.
- Review the trust score and the issues list first, then the details below it.
- Export a JSON, text or HTML report, save the PEM certificate, or copy the SHA-256 fingerprint for pinning or comparison.
Reading the results
The trust score starts at 100 and drops for each problem: expired (-50), self-signed (-40), not yet valid or wrong hostname (-30 each), weak key, SHA-1 or MD5 signature, or a chain that does not validate (-20 each), and expiry within 30 days (-10) or 7 days (-20). 90 and above is excellent, 70 to 89 means minor issues.
- Validity: the not-before and not-after dates. Public certificates are short-lived, so automate renewal (ACME / Let's Encrypt) rather than tracking dates by hand.
- Subject Alternative Names: the hostnames the certificate is valid for. Browsers ignore the Common Name when SANs are present, and a certificate matched only through its CN gets a warning.
- Chain: the certificates sent in the handshake, validated against a public trust store. A failure with a known CA almost always means a missing intermediate.
- Key and signature: RSA below 2048 bits, ECDSA below 256 bits, DSA or a SHA-1 signature are flagged as weak. A typical good result is
ECDSA 256 bits, ecdsa-with-SHA384orRSA 2048 bits, sha256WithRSAEncryption. - Validation level: DV, OV or EV, read from the certificate policy. DV is normal for most sites and only shown for information.
To inspect a certificate file rather than a live server, use the Certificate Decoder.
Frequently asked questions
How do I check when an SSL certificate expires?
Enter the domain above and press Check Certificate: the result shows the expiry date and the days left, and warns below 30 days. From a terminal: echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate.
Why does my site show a certificate chain error?
Usually the server sends only its own certificate and not the intermediate CA certificate. Browsers that already cached the intermediate work, others fail. Configure the full chain file from your CA (for example fullchain.pem with Let's Encrypt) and check again.
What does "certificate does not match domain" mean?
The hostname you entered is not in the certificate's Subject Alternative Names. A wildcard such as *.example.com covers www.example.com but not example.com or a.b.example.com. Reissue the certificate with every hostname you serve.
Can I check a certificate on a port other than 443?
Yes. Add the port after the host, for example mail.example.com:993 or example.com:8443. The server must speak TLS directly on that port, except mail ports 587 (SMTP submission), 143 (IMAP) and 110 (POP3), where the checker asks for TLS with STARTTLS first. Port 25 cannot be tested because the hosting provider of this server blocks outbound SMTP on it, and some other ports are blocked.
Does this test TLS versions and cipher suites?
No. It inspects the certificate and its chain only. For the HTTP side of transport security, check HSTS with the HTTP Security Headers Check or the CAA & HSTS Checker.