Check any domain's live HTTPS certificate — issuer, every covered hostname, expiry countdown, negotiated TLS version and cipher, and whether the chain is actually trusted.
Free, no signup required. 10 checks/hour per IP.
Common questions
What does this tool check?
We open a real TLS connection to the domain on port 443 (the same thing a browser does), capture which TLS protocol version and cipher suite were negotiated, and read the facts off the certificate the server presents: who issued it, who it's for, every hostname it covers, and its validity window.
Why does certificate expiry matter?
An expired certificate causes every browser to show a hard security warning (or outright block the page) and breaks any API, webhook, or server-to-server integration over HTTPS to that domain — visitors and automated systems alike. Most issuers (like Let's Encrypt) auto-renew, but it's worth checking expiry directly if renewal automation ever silently breaks.
What TLS protocol version should I be using?
TLS 1.2 and TLS 1.3 are the current secure standards — TLS 1.3 is faster and more secure, and most major platforms (Chrome, major CDNs) support it today. TLS 1.0 and 1.1 are deprecated and increasingly blocked by browsers and PCI compliance requirements.
What does "chain not trusted" mean?
It means the certificate chain presented by the server doesn't validate against the public root certificate authorities trusted by default. This usually means a self-signed certificate, an expired intermediate, or a misconfigured certificate bundle — any of which will show visitors a browser security warning.