Paste a PEM certificate to inspect fields — subject, issuer, validity, SANs, SHA-256 fingerprint
SSL Certificate Checker inspects TLS/SSL certificates for any domain: validity period (expiry date), issuer (certificate authority), subject (domain names covered), SAN (Subject Alternative Names), certificate chain, cipher suite, TLS version, OCSP status, and common misconfigurations. Enter a domain to see if its certificate is valid, who issued it, when it expires, and whether it covers the right domains.
TLS (Transport Layer Security) certificates serve two purposes: authentication (proving the server is who it claims to be) and encryption (encrypting data in transit). A certificate is issued by a Certificate Authority (CA) that vouches for the domain ownership. Modern certificates use the X.509 standard and include: Subject (the domain), SANs (all covered hostnames), Issuer (the CA), validity period, public key, and a CA signature. Browsers trust certificates from CAs in their root store (about 150 CAs are trusted by default).
Certificate problems to check: expired certificate (HTTPS breaks, users see security warnings), expired root/intermediate in the chain (chain validation fails), certificate not covering the domain being served (NAME_MISMATCH error), certificate using weak cipher or SHA-1 (deprecated), self-signed certificate (untrusted by browsers), and certificate transparency (CT) log absence (required since 2018 for public trust).
Check expiry
Result: example.com → Certificate expires 2026-11-15 → 112 days remaining → ✓ Valid
Verify wildcard coverage
Result: *.example.com covers api.example.com, www.example.com → ✓ Covered
Detect chain issue
Result: Intermediate certificate missing → Certificate chain incomplete → browser may show error
What is the difference between DV, OV, and EV certificates?
DV (Domain Validation): CA only verifies you control the domain. Fast issuance (minutes), lowest cost, used by Let's Encrypt. Shows padlock only. OV (Organization Validation): CA verifies organization name and legal existence. Shows organization name in certificate details. EV (Extended Validation): rigorous verification of legal identity, jurisdiction, physical address, operational existence. Historically showed green address bar with organization name — browsers removed the EV indicator in 2019, making visual distinction between OV and EV invisible to users.
What is Let's Encrypt and why is it free?
Let's Encrypt is a non-profit Certificate Authority that provides free DV SSL certificates with 90-day validity. Funded by major tech companies and the Linux Foundation. Automated via the ACME protocol — Certbot and other ACME clients automatically obtain, renew, and install certificates. 90-day validity encourages automation (instead of annual manual renewal) and limits damage from compromised certificates. Let's Encrypt has issued over 3 billion certificates and is now trusted by all major browsers.
What does 'certificate chain' mean?
A certificate chain (or trust chain) links your site's certificate to a root CA that browsers trust. Structure: Root CA (self-signed, in browser trust store) → Intermediate CA (signed by Root CA) → Site certificate (signed by Intermediate CA). Your server must provide the full chain (site + intermediate certificates) — the root is already in the browser's trust store and doesn't need to be sent. Missing the intermediate certificate causes 'Certificate chain incomplete' errors, especially on mobile browsers.
How often do SSL certificates need to be renewed?
Currently: commercial CAs issue certificates for up to 398 days (about 13 months) — browsers no longer trust certificates with longer validity. Let's Encrypt issues 90-day certificates. The industry is moving toward 47-day certificates by 2026-2027 (Apple's proposal). Automate renewal with ACME clients (Certbot, Caddy, Traefik) or cloud providers (AWS ACM, Cloudflare) to avoid expiry incidents. Set up monitoring to alert at 30, 14, and 7 days before expiry.
What is HSTS preloading and how does it prevent certificate attacks?
HSTS (HTTP Strict Transport Security) tells browsers to always use HTTPS for your domain, refusing HTTP connections. The HSTS preload list (hstspreload.org) is a list hardcoded into browsers — domains on this list are forced to HTTPS before any connection is made, protecting even first-time visitors against SSL stripping attacks. To be included: the root domain must serve HSTS with max-age≥31536000, includeSubDomains, and preload directives. Removal from the preload list takes months — it's a permanent commitment.