Online SSL Certificate Checker

Enter a domain to see when its SSL certificate expires, whether the chain is complete and whether it has been revoked. If intermediates are missing, you get the full chain needed to fix it.

What we check

Expiry window

See the expiry date, days remaining, and whether renewal is soon.

Certificate chain

Check whether the server certificate chain is complete and identify missing intermediates.

Certificate identity

Review issuer, subject, SAN, and fingerprint details.

Reading the results

Expiry date

Certificates valid for 90 days or more are marked Expiring with 30 days or less left; shorter ones are marked once a third of their lifetime remains, so a 47-day certificate is flagged at 15 days. The maximum lifetime of public certificates is shrinking: 200 days from March 2026, 100 days from March 2027 and just 47 days from March 2029. Renewals will keep getting more frequent, and tracking dates by hand is easy to get wrong.

Is the chain complete?

Your server should send the site certificate together with its intermediate certificates; the root doesn't need to be sent. When an intermediate is missing, some browsers download it themselves, so the site can look fine in a browser while curl, HTTP libraries in most programming languages and some mobile devices fail outright. Certificates marked Missing/Error in the results are the ones your server didn't send.

Domain names and revocation

The SAN list must include the domain visitors use, or browsers show a name mismatch error (NET::ERR_CERT_COMMON_NAME_INVALID). A revoked certificate was invalidated before its expiry date and should be replaced right away. Unconfirmed means the certificate has no revocation URL or the lookup failed; it doesn't mean the certificate has a problem.

FAQ

The check looks fine, so why are some users getting errors?: Most often the domain points to several servers or CDN nodes. This tool connects to one address, and other nodes may still serve an old certificate. Check each server by IP with OpenSSL:echo | openssl s_client -connect 203.0.113.10:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -fingerprintIf only one or two users are affected, their device clock may simply be wrong.
How do I fix an incomplete chain?: Open "View Full Chain" in the results to get the site certificate plus intermediates in PEM format. On Nginx, point ssl_certificate to this file; on Apache 2.4.8 or later, put it in SSLCertificateFile. If IIS or Tomcat needs a PFX or JKS file, convert it together with your private key using the certificate converter. If the server isn't reachable from the internet, paste the certificate into the SSL certificate decoder to complete the chain.
Can I check a non-443 port or an internal server?: Ports 443, 8443, 9443 and 10443 are supported; add the port after the domain, for example example.com:8443. Internal and private addresses aren't checked for security reasons. Use OpenSSL from a machine that can reach the server, or paste the certificate into the SSL certificate decoder.
How do I check expiry and the chain from the command line?: To see the expiry date:echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -datesTo see every certificate the server sends:echo | openssl s_client -connect example.com:443 -servername example.com -showcerts
How do I get alerted before a certificate expires?: Add the site to free monitoring on LapseZero. It checks regularly and alerts you 30, 7 and 1 days before expiry by default, and right away if the chain breaks or the certificate is revoked, via email, DingTalk, Feishu, WeCom, Slack, Telegram or webhook. If you'd also like issuance, deployment and renewal automated, LapseZero can handle that too.