Free SEO Tool

Free SSL Certificate Checker

Check the SSL certificate on any domain in seconds. Expiry, issuer, hostname coverage and the full chain, plus the openssl command to run the same check yourself. No sign-up required.

How to check an SSL certificate

1. Enter a domain

Type any domain or URL. The checker opens a real TLS connection to port 443 and reads the certificate the server presents.

2. See the verdict

Valid, expiring, expired or not trusted, with the days remaining and the reason behind any warning.

3. Check the details

Issuer, validity dates, every hostname it covers, the full chain, and the openssl command to reproduce it yourself.

What this SSL checker looks at

Each is reported separately, because knowing which one failed is what tells you how to fix it.

Check	Why it matters
Expiry date	The most common cause of a sudden outage. Certificates renew automatically until the day they do not, and the failure is total.
Hostname coverage	A certificate for example.com does not cover www.example.com unless the SAN list says so. Browsers reject the mismatch outright.
Chain completeness	A missing intermediate works in the browser you tested and fails in others, which makes it one of the hardest failures to diagnose.
Trust validation	Whether the chain validates against the root store. Self-signed certificates fail here and produce a full-page browser warning.
Issuer	Which certificate authority signed it, useful when you are auditing what a host set up or confirming a migration completed.
Protocol version	The TLS version actually negotiated. Anything below TLS 1.2 is deprecated and flagged by browsers and scanners.

Does SSL affect SEO?

HTTPS has been a lightweight Google ranking signal since 2014, and the honest framing is that it is a tiebreaker rather than a lever. Adding a certificate to a site that already has one will not move anything, and no amount of certificate quality substitutes for content worth ranking.

What does matter is the failure case, and it is severe. An expired or mismatched certificate produces a full-page browser interstitial that most visitors will not click through. Traffic does not dip, it stops. Googlebot also stops crawling pages it cannot fetch securely, so an outage left unnoticed for days can cost indexation as well as sessions.

That asymmetry is the reason to check. The upside of a valid certificate is small and the downside of a broken one is total, which makes expiry monitoring the part worth automating.

How to check an SSL certificate with openssl

If you would rather not paste a domain into a website, openssl does the same job locally. Fetch the certificate with s_client and read it with x509:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer

The -servername flag is the part people leave off. Without it there is no SNI header, so a server hosting several sites on one IP cannot tell which certificate to send, and you get the default rather than yours. Your results above include this command with your own domain already filled in.

To read a certificate file rather than a live server, use openssl x509 -in certificate.crt -text -noout.

Frequently asked questions

How can I check my SSL certificates?

Enter your domain in the tool above and it opens a real TLS connection, reads the certificate the server presents and reports the expiry, issuer, covered hostnames and chain. In a browser you can click the padlock in the address bar and view the certificate details. From a terminal, use the openssl command shown with your results.

How to check if a certificate is valid or not?

Three things have to hold at once. The current date must fall between the valid from and valid to dates. The hostname you are visiting must be covered by the common name or the subject alternative names. And the chain must lead to a certificate authority in the trust store. Failing any one produces a browser warning. The tool above checks all three separately, so you see which one failed.

How to check if a security certificate is valid?

The quickest check is the padlock in your browser's address bar: click it and view the certificate. That tells you what your browser thinks, on your machine, with your trust store. For anything shared or automated, use the checker above, since it also reveals problems browsers paper over, such as a missing intermediate that your browser happens to have cached.

How do I check if my SSL certificate is working?

Load your site over https and look for a padlock with no warning. That is necessary but not sufficient, because your own browser may have cached an intermediate certificate that other visitors will not have. Running an external check like this one tests what a fresh visitor actually receives, which is the case that matters.

How do I check if my SSL certificate is expired?

The tool above shows the exact expiry date and the days remaining, counting negative once it has passed. Expiry is the single most common cause of a sudden HTTPS outage, because certificates renew silently until something breaks the renewal, and then the failure affects every visitor at once with no warning.

How can I check the expiration date of my SSL certificate?

Enter the domain above and read the valid to date, with the days remaining shown alongside. From a terminal the equivalent is: openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates, which prints notBefore and notAfter.

How can I check if an SSL certificate is valid?

Check the dates, the hostname coverage and the chain, in that order, since each failure produces a different browser message. The tool above reports each separately rather than collapsing them into one pass or fail, because knowing that a certificate is valid but does not cover your www subdomain tells you exactly what to fix.

How to check SSL cert from command line?

Use openssl s_client to fetch the certificate and openssl x509 to read it: openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer. The servername flag matters, since without it the server cannot tell which certificate to send on a shared IP. Your results above include this command with your own domain filled in.

How can I view an x509 certificate using OpenSSL?

For a certificate file on disk: openssl x509 -in certificate.crt -text -noout, which prints every field including extensions. For a live server, pipe s_client into x509 as shown above. Add -text to see the full detail, or use targeted flags such as -dates, -subject, -issuer and -ext subjectAltName to print only what you need.

Where can I see my SSL certificate?

In a browser, click the padlock in the address bar and choose the certificate or connection details option. On a server it depends on setup: Nginx points at it with ssl_certificate in the site config, Apache with SSLCertificateFile, and Let's Encrypt stores certificates under /etc/letsencrypt/live/yourdomain/ by default.

How can I decode an SSL certificate?

Decoding turns the base64 PEM block into readable fields. Locally that is openssl x509 -in certificate.crt -text -noout. The checker above effectively decodes the live certificate for you, showing subject, issuer, validity, alternative names and serial number without you needing to fetch the file first.

How to use a certificate decoder?

A decoder takes the certificate text, everything between BEGIN CERTIFICATE and END CERTIFICATE, and displays the fields inside. Use one when you have been handed a certificate file and need to confirm what it covers before installing it. If the certificate is already live on a server, checking the domain directly is faster and tells you what visitors actually receive.

Can I decode my CSR online?

A certificate signing request is a different object from a certificate, and this tool reads live certificates rather than CSRs. To decode one locally, use openssl req -in request.csr -text -noout, which shows the subject and public key you are asking a certificate authority to sign. Avoid pasting a CSR into a random online tool, since the associated private key is what secures your site.

How can I decode a PFX certificate?

A PFX or PKCS#12 file bundles a certificate with its private key and is password protected. Extract the certificate with openssl pkcs12 -in file.pfx -clcerts -nokeys -out certificate.crt, then read it with openssl x509. Do this locally rather than uploading the file anywhere, because a PFX contains the private key.

How can I monitor my SSL certificate expiration?

One-off checks catch a problem you already suspect. For ongoing cover you want automation: a scheduled job running the openssl command and alerting under a threshold, an uptime service with certificate monitoring built in, or the expiry notification emails most certificate authorities send. Let's Encrypt certificates last 90 days, so manual checking is not a workable strategy.

What is the best online certificate checker?

For depth on protocol and cipher configuration, Qualys SSL Labs remains the most thorough and grades your whole TLS setup. For a fast answer to whether a certificate is valid, when it expires and what it covers, the tool above returns that in a couple of seconds without a queue, and gives you the openssl command to check it yourself afterwards.

Start free today

Millions of people will ask AI about your category this week

RankSpot researches, writes and publishes daily, and sends you the short list of what's left. Free for 3 days.

Start free trial