Checking certificate...
Enter a hostname and optional port to inspect its SSL/TLS certificate.
What Is an SSL/TLS Certificate?
An SSL/TLS certificate is a digital credential that proves a website's identity and enables encrypted communication between a browser and a server. TLS (Transport Layer Security) is the modern successor to SSL (Secure Sockets Layer), though the term "SSL certificate" remains the most commonly searched name.
When you visit a website over HTTPS, your browser verifies the server's certificate against a trusted certificate authority (CA). If the certificate is valid and matches the hostname, the browser displays a padlock icon and encrypts all data sent to and from the site. If the certificate is expired, self-signed, or issued for a different hostname, visitors see security warnings that erode trust and drive them away.
Every certificate contains essential metadata: the subject (who it belongs to), the issuer (which CA signed it), the serial number, the signature algorithm, validity dates, and a list of subject alternative names (SANs) that define which hostnames the certificate covers.
Why Check Your SSL Certificate Regularly?
Certificate expiry is one of the most common causes of unexpected website downtime. When an SSL certificate expires, browsers block visitors with full-page warnings, search engines may downgrade rankings, and APIs that rely on HTTPS will fail outright.
- Avoid downtime: Renew certificates at least 7–14 days before expiry to account for DNS propagation and CA processing delays.
- Protect SEO: Google uses HTTPS as a ranking signal. An expired certificate can cause pages to drop out of search results.
- Maintain trust: Visitors expect the padlock. Warnings increase bounce rate and reduce conversions.
- Verify configuration: Confirm that SANs cover all required subdomains and that the chain is complete.
Understanding Certificate Fields
Each field in a certificate serves a specific purpose. Here is what our SSL checker displays and why it matters.
| Field | Meaning |
|---|---|
| Subject | The entity the certificate is issued to, usually the organization or domain owner. |
| Issuer | The certificate authority that signed and vouches for the certificate. |
| SANs | Subject Alternative Names list every hostname the certificate protects. |
| Serial Number | A unique identifier assigned by the CA for revocation and audit purposes. |
| Signature Algorithm | The cryptographic method used to sign the certificate (e.g., RSA with SHA-256). |
| Valid From / Until | The date range during which browsers will accept the certificate as valid. |
| TLS Version | The protocol version negotiated during the handshake (TLS 1.2 or 1.3 recommended). |
Frequently Asked Questions
What happens when an SSL certificate expires?
Visitors see a full-screen security warning in their browser and most will leave immediately. Search engines may remove or downgrade the site. API clients and automated services that require HTTPS will fail. Renewal should happen at least one to two weeks before the expiry date.
What is the difference between SSL and TLS?
SSL is the older protocol (versions 1.0–3.0) and TLS is its modern, more secure successor (versions 1.0–1.3). Today, almost all "SSL certificates" are actually X.509 certificates used with TLS. The name "SSL" stuck because it is what most people search for and understand.
Can I use this tool to check any HTTPS website?
Yes — as long as the server speaks TLS and accepts connections on the port you specify. The tool performs a standard TLS handshake and reads the publicly presented certificate. It does not attempt authentication or transmit any sensitive data.
Why does my certificate show as self-signed?
A self-signed certificate is one where the subject and issuer are the same entity. Browsers do not trust self-signed certificates by default because there is no independent CA verifying the owner's identity. Self-signed certs are fine for internal testing but should never be used on public-facing production sites.
Which TLS version should my server support?
TLS 1.2 and TLS 1.3 are the only versions considered secure today. TLS 1.0 and 1.1 are deprecated and should be disabled. TLS 1.3 offers the best performance and security, but TLS 1.2 is still widely required for compatibility with older clients.
Related Calculators
DNS Record Lookup
Query A, AAAA, MX, NS, TXT, CNAME, and PTR records.
URL Encoder / Decoder
Percent-encode special characters for URLs and APIs.
HTTP Status Code Reference
Search HTTP response codes, meanings, and RFC references.
JWT Token Decoder
Decode JSON Web Tokens and inspect claims instantly.
CIDR Calculator
Analyze, split, and summarize IPv4 or IPv6 CIDR blocks.
Bandwidth Calculator
Calculate download time, transfer speed, and data usage.