SSL certificate checker

An expired or mismatched certificate puts a full-page warning in front of every visitor. Enter a web address to check the certificate, how long it has left, the TLS version and the security headers the site sends.

What it checks

What this tool checks

Security and HTTPS

HTTPS and redirect. The site loads securely, and http:// addresses forward to https://.
Certificate. Trusted, matching the domain, and how many days until it expires.
TLS version. TLS 1.2 or 1.3; older versions are refused by current browsers.
Security headers. HSTS, content type, framing, referrer and content security policies.

Email authenticationalso checked

MX records. Which servers receive mail for the domain.
SPF. One record that lists the servers allowed to send as you.
DKIM. A signing key under the 20 most common selector names.
DMARC. A policy telling receivers what to do with mail that fails the checks.

Search basicsalso checked

Title and description. Present, and a length that fits in search results.
Headings and language. One H1, and the page language declared.
Mobile viewport. Phones get the mobile layout, which Google uses for ranking.
Canonical and indexing. No accidental noindex, and one preferred address per page.
robots.txt and sitemap. Crawlers are let in and can find every page.
Sharing preview. Open Graph title and image for links shared on social apps.

Speedalso checked

Server response. Time to the first byte, measured from our server.
Compression. Gzip or Brotli on the HTML.
Mobile speed score. Google Lighthouse on a simulated mid-range phone.
Core Web Vitals. Largest Contentful Paint, layout shift and main-thread blocking.

Why certificates expire

Certificates are valid for a limited time, and the limit is shrinking. Under rules agreed by browsers and certificate authorities in 2025, the maximum drops from 398 days to 200 days in March 2026 and keeps falling until it reaches 47 days in 2029. Sites that renew by hand will run into expiry problems far more often, so automatic renewal matters more each year.

What security headers do

Security headers are instructions your server sends with every page. HSTS keeps browsers on HTTPS, X-Frame-Options stops other sites from showing yours inside a frame, and a Content-Security-Policy limits which scripts can run. They cost nothing to add and block whole classes of attack.

FAQ

Frequently asked questions

What does a certificate problem mean?

Browsers will show a security warning instead of your site. The usual causes are an expired certificate, a certificate issued for a different name (for example without www), or a missing intermediate certificate on the server.

How do I stop my certificate from expiring?

Use automatic renewal: certbot on your own server, your host's built-in SSL, or Cloudflare. Then set a reminder three weeks before the expiry date the checker shows, in case renewal fails silently.

Is a free certificate as secure as a paid one?

Yes. Let's Encrypt and paid certificates use the same encryption. Paid certificates add things like a warranty or organisation details, which browsers no longer display.

Free tools