Check an SSL certificate
Expiry date, issuer, and above all the names the certificate really covers. That last line explains most browser warnings.
How to read this result
A certificate that causes trouble almost always does so for one of three reasons, and this page separates them on purpose.
The expiry date
Everyone looks at this line, and it is the least interesting one when all is well. Free certificates last three months and renew automatically: one expiring in forty days needs no action, it will be renewed around day thirty. A free certificate with less than two weeks left, on the other hand, almost always means the automatic renewal is broken rather than forgotten.
The covered names
This is the line that explains the puzzling case: a valid, unexpired certificate and a browser that complains anyway. A certificate covers a specific list of names. If it carries example.com and the visitor lands on www.example.com, it does not apply, and the warning is correct.
A wildcard certificate, written *.example.com, covers www.example.com and shop.example.com, but not example.com on its own, and not a.b.example.com either. A wildcard covers exactly one level. That rule surprises people, and it is behind a good number of half-correct setups.
The issuer
It changes nothing about the security of the connection: a free certificate encrypts exactly as well as a paid one. What it tells you is how renewal is handled, and therefore where to look when the date gets close.
What this tool does not do
- It does not judge the server TLS setup: accepted protocol versions, cipher suites, OCSP stapling. That is a different subject, and other tools do it better.
- It renews nothing and warns nobody. It is a reading taken at the moment you ask for it.
- It checks one domain at a time. Thirty sites need monitoring, not a hand-typed check every Monday.
Frequently asked questions
Why is my certificate valid here and refused by my browser?
Almost always because it does not cover the exact name you are visiting. Look at the “covers the requested domain” line: a certificate for example.com is not valid for www.example.com, and the other way round.
How many days out should I start worrying?
It depends on the certificate lifetime. For a free three-month certificate, renewal normally happens at thirty days: under fifteen, the automatic mechanism is probably broken. For a yearly certificate, thirty days leaves plenty of time.
Do you check subdomains too?
Only the one you type. The other names covered by the same certificate are shown, but each can be served by a different certificate: to be sure, check the subdomain directly.
Going further
Expired SSL certificate: what your visitors see Not a warning banner, a full-page red block that most people never get past. Why it happens on a working server, and how to stop it happening.The other tools
Check a domain name
Expiry date, registrar and status of a domain name.
Check redirects
The whole redirect chain, hop by hop, with the type of each one.
Check a backlink
Whether the link is there, with which anchor, dofollow or nofollow.
Be warned before expiry, not after
Expansel reads the certificate of your HTTPS sites at every check and alerts you as the expiry approaches, not on the day the browser shows a crossed-out padlock.