SSL Checker
SSL Certificate Checker
Enter a domain. We open a TLS connection and read its certificate: issuer, expiry and days remaining, SAN coverage, whether the hostname matches, and whether the intermediate chain is complete. Run it right after a migration — re-issued certs and missing intermediates are a classic post-cutover surprise.
What this checks
- Expiry: days remaining, with warnings under 30 days and 14 days.
- Hostname match: the domain must be in the subject CN or SAN.
- Issuer: who signed it, and a self-signed flag.
- Chain: whether intermediates are served (a missing chain breaks some clients).
- Signature: flags weak SHA-1/MD5 signatures.
Frequently asked questions
How early should I renew a certificate?
Renew at least 30 days before expiry. The tool warns under 30 days and flags urgently under 14.
What is a hostname mismatch?
The domain isn't in the certificate's subject or SAN list, so browsers show a warning. Reissue the cert to cover the hostname.
What is an incomplete chain?
The server sent only the leaf certificate, not the intermediates. Some clients then fail to trust it — install the full chain.
Related free tools
- All tools — browse every free hosts.click tool.
- Security headers — grade your HTTP security headers.
- Redirect checker — trace the full redirect chain.