SSL Certificate Checker
Issuer, expiry, chain and hostname match
Read the certificate a site actually serves: who issued it, when it expires, how many days are left, whether the chain validates in a browser, and whether it covers the hostname you asked for. Expired and self-signed certificates are reported rather than treated as an error.
Frequently asked questions
How many days before expiry should I renew?
Automated issuers like Let's Encrypt renew at 30 days remaining, which leaves plenty of room to notice a failure. If you renew by hand, treat 14 days as the point to act.
What does "chain not valid" mean?
The certificate itself may be fine, but the server is not sending the intermediate certificate that links it to a trusted root. Browsers on desktop often paper over this; many mobile clients and API clients do not.
Why does the hostname not match?
The certificate covers different names than the one you requested. A certificate for example.com does not cover www.example.com unless that name is listed too — a wildcard like *.example.com covers one level of subdomain, not the bare domain.