Free tool

SSL certificate checker

Check when a TLS certificate expires, who issued it, which host names it covers and whether browsers will trust it.

Free to use, limited to 30 checks per hour per IP address. Results may be cached for a few minutes. More free tools

What this checker reports

Days remaining and expiry date, so you know how much time is left before browsers show a warning.
Trusted chain: whether the certificate validates against public roots for the host you entered. Self-signed certificates, wrong host names and missing intermediate certificates fail here.
Issuer and subject, including the certificate authority that signed it.
Names covered: every host name in the Subject Alternative Name list.
TLS protocol negotiated, such as TLSv1.3.

Why certificates still expire in production

Automated renewal fails quietly more often than teams expect: a DNS change breaks the ACME challenge, a load balancer keeps serving an old certificate, or a renewal cron job stopped running months ago. The first sign is usually a customer reporting a browser warning.

An SSL monitor checks the certificate your server actually serves and alerts you when fewer than 14 days remain (configurable from 1 to 90), or the moment the chain stops validating.

Frequently asked questions

Which port does the checker use?

Port 443, with the domain you entered sent as SNI, so the result matches what a browser sees for that host name.

Why does it say 'not trusted' when my browser shows a padlock?

Browsers can sometimes fetch a missing intermediate certificate on their own. Other clients, such as APIs, mobile apps and command-line tools, cannot. Serve the full chain from your server.

How many days before expiry should I renew?

Let's Encrypt renews at 30 days remaining. An alert at 14 days gives you two weeks to fix a failed renewal.

Monitor this continuously — free

Asniher runs these checks on a schedule, verifies failures to avoid false alarms, and alerts you by email, Slack or Discord.

Start monitoring free See pricing