SSL Certificate Checker
Check a domain's SSL certificate expiry, issuer, chain and TLS version live.
SSL Certificate Checker reads the live TLS/SSL certificate served by a domain and shows its expiry date, issuer, subject (CN), alternative names (SAN), TLS protocol and key sizeat a glance. Because it inspects the certificate the server actually presents, you see exactly what sits behind the browser's padlock.
The most important signals are the days remaining until expiry (D-day) and whether the chain is trusted. A near expiry means it is time to renew; a trust failure (authorized=false) points to a missing intermediate certificate or a hostname mismatch. Just enter a domain — no protocol or path needed.
Expiry and renewal cycles
Publicly trusted certificates typically last from 90 days (Let's Encrypt) to a year. An expired certificate triggers a hard red browser warning that blocks visitors, so watch the renewal state from about 30 days out. This tool shows the days remaining as a large D-day, flagging 30 days or fewer as a warning and an expired certificate as danger.
Chain trust and hostnames
A certificate is never trusted on its own; the one the server sends is verified through a chain that leads up to a trusted root. Common failures include:
- The server does not bundle the intermediate certificate, leaving the chain incomplete
- The requested domain is not listed in the certificate's CN/SAN, causing a name mismatch
- The certificate has expired or is not yet valid
When trust fails, the authorizationError code (for example expired, self-signed, or name mismatch) helps you narrow down the cause.
The role of SAN (alternative names)
Modern browsers only use the certificate's SAN (Subject Alternative Name) list for hostname validation. Even if a domain appears in the CN, it will not be trusted unless it is in the SAN. Wildcards (*.example.com) and multi-domain certificates are common, so confirm that the domain you are checking is actually present in the SAN list. To read the SAN from a certificate file you already have, paste it into the SSL Certificate Decoder, and to confirm which protocols the same host accepts use the TLS Version Check.