SSL Certificate Check
Type a host. We open a real connection, read the certificate it serves and say what it is worth — including on the ports a browser never shows you.
Two different “it does not work”
A certificate that does not cover the name you asked for and one whose chain cannot be validated look the same in a browser and are fixed in different places: the first has to be requested again with that name inside; the second is usually the intermediate certificate missing from the server — which shows up on other people’s machines and not on yours, because yours already has it.
What this does not tell you
One look from one machine. A certificate that renews itself can stop renewing without saying so, and you find out on the day it expires — which is a Sunday often enough to be worth not finding out that way.
If you are here, this is usually what comes next
Want to be told before it expires
This is a one-off look. Watching it and warning you 30, 14, 7, 3 and 1 days before is what monitoring does — and it watches the renewal, which is what actually fails.
Frequently asked questions
- My certificate renews by itself. Why check it?
- Because a renewal that stops working does not announce it. The command is still in the timer, the last renewal is still on disk, and the only signal is the site going red on the day it expires. Looking takes two seconds; being told takes none.
- It works in my browser but here it says it cannot be validated. Who is right?
- Both, and that is the point. Your browser already holds the intermediate certificate from some other site you visited, so it fills the gap on its own. A machine that has never seen it — a phone, an app, another server — cannot, and for them the site is broken.
- Why can I ask for a port other than 443?
- Because the certificate that breaks your mail is the one on 993 or 465, and no browser will ever show it to you. It is the same machine, a different service, and very often a certificate nobody remembered to renew.