Free SSL Certificate Checker

Type a domain and we connect to port 443, read the certificate your server really sends and list what to fix first.

Short answer

This SSL certificate checker connects to port 443 of the domain you enter and reports the certificate owner, issuer, expiry date and days left, whether the name matches, the chain your server sends, any missing intermediate certificate, and which TLS versions are accepted. Findings are sorted by priority, so you can see at once what to fix first.

Last updated: 2026-10-18

What does an SSL checker test?

An SSL checker tests what a visitor's device receives when it opens a secure connection to your server, which is not always what you think you installed. This tool makes that connection from our server and reports on the result.

Expiry: the validity dates and the number of days left.
Name match: whether the domain you typed is listed in the certificate, including wildcards.
Chain: every certificate your server sends, in order, and whether an intermediate certificate is missing.
Trust: whether the chain ends at a public root certificate authority.
Key and signature: key type and size, and weak signature algorithms.
TLS versions: separate handshakes for TLS 1.3, 1.2, 1.1 and 1.0.
HSTS: whether the site tells browsers to use HTTPS only.

Unlike a browser, the checker does not cache intermediate certificates. That is why it can catch a missing intermediate that Chrome quietly repairs on your own laptop.

How do I use this SSL checker and read the result?

Enter the domain, press the button and read the findings from the top: the list is sorted so problems come first, then warnings, then notes, then passed checks.

Type the domain without a path, for example example.ae. A full address such as https://example.ae/ is also accepted.
Press Check SSL. Testing the four TLS versions usually takes a few seconds.
Fix every item marked Problem first. These break connections for some or all visitors.
Look at the Warnings, such as old TLS versions or a certificate that expires within 30 days.
Run the check again after each change. If you changed a certificate, remember to reload the web server first.

Each finding has a plain explanation and the usual fix. The chain section lists the certificates exactly as your server sent them, so you can compare them with the files you installed.

What are the most common SSL problems and how are they fixed?

Most failures come from a short list of causes, and each has a standard fix.

Finding	What it means	Usual fix
Expired certificate	The end date has passed; browsers show a full-page warning.	Renew, install, reload the server, then check auto-renewal.
Name mismatch	The typed name is not in the certificate.	Reissue with the exact name, or add the www and non-www versions.
Missing intermediate	The server sends only its own certificate.	Install the full chain file. See the chain completer.
Self-signed or private root	No public authority vouches for it.	Use a certificate from a public authority for public sites.
TLS 1.0 or 1.1 enabled	Retired protocol versions are still accepted.	Disable them and keep TLS 1.2 and 1.3.

A certificate for an .ae site that quietly expires puts a warning page in front of customers who arrive from search or from a WhatsApp link, so expiry is worth monitoring even when everything else works.

What can this checker not see, and when should I use something else?

This is a point-in-time check of one server address from one location, so it has clear limits.

It tests the first IP address that DNS returns. A site behind a load balancer or CDN may show different certificates on other addresses.
It does not query revocation lists or OCSP, so a revoked certificate can still look valid.
It cannot read OCSP stapling, because PHP does not expose the stapled response.
It checks port 443 only; mail servers and other TLS services are not covered.
It does not simulate old devices.

The domain is sent to our server because the connection is made from there. We do not store the domain or the result. For a certificate you have not installed yet, use the certificate decoder instead, because this checker needs a live server.

If certificates keep expiring or chains keep breaking, Tooba Web's hosting and SSL service can help with installation and renewal.

Frequently asked questions

Why does the checker show an error when my browser shows no warning?

Browsers remember intermediate certificates they have seen before and can also download missing ones from a link inside the certificate. This checker uses only what your server actually sends, as curl, many apps, API clients and some phones do. The error is real: it simply hides on your own device, so install the full chain.

How many days before expiry should I renew an SSL certificate?

Renew at least two weeks before the end date, and sooner if renewal is manual. The checker marks a certificate with 30 days or fewer left as a warning and 14 days or fewer as a problem. If your certificate renews automatically, check that the renewal job really runs and that the server reloads afterwards.

Is it safe to enter my domain into this tool?

Yes. A certificate is public information: anyone who connects to your server receives it. We make that same connection from our server, read the certificate and report on it. We do not store the domain or the result, and the tool needs no account. It never asks for private keys.

Why are TLS 1.0 and 1.1 flagged as a warning?

Both versions were retired years ago and modern browsers no longer accept them. Leaving them enabled fails many security scans, including card-payment compliance scans. Disabling them rarely affects real visitors. Keep TLS 1.2 and TLS 1.3 enabled, and test your site again after the change.

Can I check an IP address, a port other than 443 or a mail server?

No. The tool accepts domain names only, and only port 443, so that it cannot be used to probe private networks or other services. Names that point to private or reserved addresses are refused. For mail servers and other TLS ports, use a command line client such as openssl s_client.