SSL certificate checker
Enter a domain to check the certificate it serves on port 443: who issued it, when it expires, which names it covers and whether browsers and other clients will trust the chain.
What the checker does
The checker opens a TLS connection to the host on port 443, sending the host name so the server picks the right certificate, and reads the certificate and chain the server sends. It then verifies the chain against the same trusted root certificates Node.js uses and checks the certificate covers the host name. Nothing is cached: every check is live, and results aren't saved.
Only public hosts can be checked. Addresses on private networks, loopback and cloud metadata addresses are refused, and each network can run a few checks a minute.
Reading the results
- Expiry: the date the certificate stops being valid. Certificates from automated authorities usually last 90 days or less and renew about a month before they expire, so fewer than 14 days left suggests renewal has stopped working.
- Subject and issuer: who the certificate is for and which authority signed it.
- Names covered: the subject alternative names. Browsers only use this list, so the host you typed has to be on it, either exactly or through a wildcard such as
*.example.com. - Chain sent: the certificates the server sent, starting with its own. Most sites send their own certificate and one intermediate.
- Protocol: the TLS version agreed for this connection.
Common problems
Chain can't be verified
Usually the server sends its own certificate but not the intermediate. Desktop browsers often cope because they've seen the intermediate before; API clients, mobile apps and tools like curl fail. Configure the server with the full chain file your certificate authority provides, often called fullchain.pem.
Name doesn't match
The certificate was issued for other names. Common causes are a missing www variant, a new subdomain that wasn't added, or a server answering with its default certificate because it doesn't recognise the host name.
Expired or expiring soon
Check the renewal job: its logs, its DNS or HTTP validation, and whether the web server was reloaded after the new certificate was written.
Stop checking by hand
A certificate that's fine today can expire next month. SSL certificate monitoring checks it for you and alerts you days ahead, and when the chain or host name goes wrong. It's included on every plan, including Free.
Set up your first monitor in under a minute
Uptime Dog is free for up to 20 monitors. No card needed.
Start monitoring free