Free · live registry data · no login

SSL Certificate Checker

Issuer, expiry, chain and hostname match.

How it works

Check any site's SSL certificate: issuer, expiry, SANs and hostname match

Enter a domain and we open a real TLS connection to it from our server, read the certificate the site presents and tell you whether a browser would trust it. You see the issuer (Let's Encrypt, DigiCert, Cloudflare and so on), the exact valid-from and valid-to dates, how many days remain, the TLS protocol negotiated and every hostname the certificate covers. We also check the www variant, because the most common SSL mistake is a certificate that covers one and not the other.

Results appear here after you click Check certificate.

How this works

1
Real TLS handshake
Our server connects to the host on the port you chose and records the certificate it presents.
2
Validate like a browser
We verify the chain against trusted roots, check the hostname against the subject and SAN list, and compute days to expiry.
3
Check the www variant
For a bare domain we also test www. so you catch certificates that cover one name but not the other.

Frequently asked questions

What does 'hostname mismatch' mean?: The certificate is valid but was issued for different names. For example a certificate for www.example.com does not cover example.com unless both are listed as Subject Alternative Names. Reissue the certificate including every hostname you serve.
Why does my site work in my browser but fail here?: Your browser may have cached an older certificate, or you are being served from a different edge node. It can also mean your server does not send the intermediate certificate; browsers sometimes fetch it silently while strict clients do not. Fix it by installing the full chain.
How long do SSL certificates last?: Let's Encrypt and most free certificates last 90 days and renew automatically. Paid certificates are limited to 398 days. Industry rules are shortening maximum lifetimes further, so automated renewal is the only sane approach.
Does MailShrine include SSL?: Domains at MailShrine come with DNS and you can issue free Let's Encrypt or Cloudflare certificates for any site you point them at. If you build with the MailShrine site tools, HTTPS is handled for you.
Can I check a mail server certificate?: Yes. Enter the mail hostname and set the port to 993 (IMAPS), 465 (SMTPS) or 995 (POP3S). STARTTLS on 587 or 143 is not supported by this tool because the certificate is only sent after a protocol upgrade.

Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.