SSL Certificate Checker — expiry, chain, TLS and domain renewal

What this SSL checker looks at

An SSL certificate (strictly, a TLS certificate) proves to a visitor's browser that it is talking to your server and nobody in between. When it expires, doesn't match the hostname, or can't be traced back to a trusted authority, browsers replace your site with a full-page "Your connection is not private" warning — and almost everyone leaves. This checker connects to your server the way a browser does and reports everything that decides whether that warning appears:

• Expiry — the exact date and time the certificate lapses, the days left, and how much of its lifetime has passed.
• Hostname coverage — every name on the certificate (its Subject Alternative Names) and whether the one you typed is among them. *.example.com covers www.example.com but not example.com itself.
• Chain and trust — the intermediate certificates your server sends, whether a standard client trusts the result, and whether an intermediate is missing.
• Protocols — the TLS version negotiated, and whether the server still accepts the retired TLS 1.0 and 1.1.
• HSTS and redirects — whether HTTPS is enforced with Strict-Transport-Security, and whether http:// redirects to https://.
• Domain registration — when the domain itself expires, who the registrar is, its registry status codes, DNSSEC, nameservers, and the CAA records that say which certificate authorities may issue for it.

How to read the result

The grade

Every problem caps the grade, and the report tells you which one did. An expired, mismatched, self-signed or untrusted certificate is an F, because browsers block the site. A certificate that expires within seven days is a C. Accepting TLS 1.0/1.1 or leaving out the intermediate certificate is a B. Everything correct earns an A, and TLS 1.3 plus at least six months of HSTS plus an http-to-https redirect earns the A+.

The validity timeline

The bar runs from the day the certificate was issued to the day it expires, with today marked. The shaded last third is where automated renewals normally happen: ACME clients such as certbot renew when about a third of the lifetime is left. A Let's Encrypt certificate sitting deep in that zone with no replacement is usually a renewal job that stopped working weeks ago — a DNS API token expired, a firewall started blocking the validation request on port 80, or the server was rebuilt without the timer.

Bulk mode

Agencies and IT teams rarely look after one site. Paste up to ten domains, one per line, and you get a sortable table — certificate days left, issuer, TLS version, domain expiry and the worst problem for each — sorted so the next thing to expire is at the top. Click any row for its full report, or export the table as CSV for a client report or a renewal spreadsheet.

Fixing the most common problems

Expired or about to expire

Renew it, then find out why renewal didn't happen on its own. With certbot, certbot renew --dry-run shows the error without changing anything. On managed hosting, the SSL or "Let's Encrypt" panel usually has a log. After renewing, reload the web server — a renewed certificate on disk does nothing until nginx or Apache picks it up — and press Recheck now.

Missing intermediate certificate

If the site works in Chrome but curl, a payment provider's webhook or a mobile app fails with "unable to get local issuer certificate", your server is sending only its own certificate. Browsers fetch the missing intermediate themselves; most other software doesn't. Point your server at the full chain: fullchain.pem for certbot, or your certificate with the CA's bundle appended for a commercial certificate.

Old TLS versions still enabled

TLS 1.0 and 1.1 were formally deprecated in 2021, every current browser has dropped them, and PCI DSS requires them off. Allow only TLS 1.2 and 1.3:

# nginx
ssl_protocols TLSv1.2 TLSv1.3;

# Apache
SSLProtocol -all +TLSv1.2 +TLSv1.3

Behind Cloudflare, the setting is under SSL/TLS → Edge Certificates → Minimum TLS Version — its default still allows TLS 1.0, so many otherwise well-configured sites fail this check until someone changes it.

Hostname mismatch

Reissue the certificate with the missing name added as a Subject Alternative Name (with certbot, --expand and an extra -d). A redirect doesn't help on its own: the browser checks the certificate before it ever sees the redirect.

Why certificate expiry needs watching now

Certificates are getting much shorter. Under the CA/Browser Forum's ballot SC-081, publicly trusted certificates may last at most 200 days from 15 March 2026, 100 days from 15 March 2027 and just 47 days from 15 March 2029. Let's Encrypt, which issues most of the web's certificates, stopped sending expiry reminder emails in June 2025 and recommends an independent monitor. More renewals and fewer reminders means automation that fails silently will, sooner or later, take a site down.

The same goes for the domain itself. An expired domain takes the website and its email offline, and a lapsed registration can be bought by someone else once it is released. The domain check here reads the registry's own records — RDAP, or WHOIS for registries such as .io and .co that haven't moved to RDAP — rather than guessing from a cached third-party database.

Check the rest of your setup

A valid certificate is the foundation; the headers on top of it decide how much protection visitors actually get. Run the Security Headers Checker for HSTS, Content-Security-Policy and friends, the Redirect Checker to make sure every http:// and www variant ends on the right https URL in one hop, and the SEO & AI Visibility Audit for everything a search engine sees on the page.

Let Monity watch the dates for you

This checker answers "is it fine today?". Monity answers "will it still be fine next month?": it checks your certificates and domains every day and alerts you in email, Slack or Teams when a certificate is within 14 days of expiring, a domain within 30, or when the issuer or nameservers change without warning — a sign of an unplanned migration or, worse, a hijack. The free plan watches three sites, forever.