Free SSL Certificate Checker

This one reads the certificate a domain presents and reports whether it is inside its validity dates, how many days remain, who issued it, and the TLS version negotiated. Each result also says whether the chain to a trusted root and the hostname were verified. The Certificate Chain Checker lists every certificate the server sends, and finds a missing or expired intermediate.

We recommend checking weekly for critical production domains and daily if you are within 30 days of expiry. Automated monitoring (like CertNotify) handles this for you — checking every day, and emailing you daily once the certificate is inside the lead time you choose: 30 days on Free, up to 60 on Pro and 90 on Business.

A certificate chain is the sequence of certificates from your domain's certificate up to a trusted root CA. The server must send every intermediate. When one is missing, most browsers fetch or already hold it, but API clients, curl, Android apps and some bots refuse the connection. An expired intermediate, or a chain ending at a root browsers do not trust, makes browsers show a security warning even if your own certificate is valid.

It is set by TLS protocol versions and nothing else: A+ for TLS 1.3, A for TLS 1.2, and lower when the server still accepts TLS 1.1 or 1.0. Each result says whether those older versions were tested; when they were not, the grade reflects only the version a modern client negotiates. Certificate trust, cipher suites and HSTS do not affect it.

Our checker works for any publicly accessible domain or IP address. For internal or private servers, you would need to run a local tool like openssl or a self-hosted scanner.

The certificate was issued by a CA that is not in the browser or OS trusted root store, it is self-signed, or it does not cover the hostname. Visitors see a full-page security warning in their browser. An incomplete chain — a missing intermediate certificate — is different: most browsers fetch or already hold the intermediate, but API clients, curl, Android apps and some bots refuse the connection.