SSL Certificate Checker

How to use the SSL checker

1. Enter a domain name such as example.com, or paste a full web address.
2. Press Check SSL.
3. Read the summary at the top, then the certificate details and the HTTPS checks below it.

The checker does four things at once. It connects to the site over HTTPS. It finds the newest certificate for the name in public Certificate Transparency logs. It checks whether plain http:// redirects to https:// and whether the site sends an HSTS header. Finally it reads the domain's CAA records, which say which certificate authorities may issue certificates for it.

Where the certificate data comes from

Since 2018, browsers only trust a public certificate if it was recorded in Certificate Transparency (CT) logs: public, append-only lists that anyone can search. We read them through crt.sh, a free CT search service, and show the most recent certificate that is valid today and covers the name you entered.

A server can hold more than one valid certificate, so the one it actually sends you may be a different one with similar dates. If you just renewed and the old dates still show, wait a few minutes: new certificates can take a while to appear in the logs.

What the results mean

Common certificate problems and fixes

1. The certificate expired. Renew it with your host or certificate authority. With Let's Encrypt, check that the automatic renewal job (certbot or your control panel) still runs.
2. The name does not match. The certificate covers www.example.com but not example.com, or the reverse. Issue a new certificate that lists both names.
3. No redirect to HTTPS. Add a permanent (301) redirect from http:// to https:// in your web server or CDN settings.
4. No HSTS header. Add Strict-Transport-Security: max-age=31536000; includeSubDomains once every subdomain works over HTTPS. Read what is HTTPS for background.
5. Renewal fails after adding CAA. Make sure the CAA record lists the authority that issues your certificates, for example 0 issue "letsencrypt.org".

To see every header the server sends, use the HTTP headers checker. To read the CAA and other DNS records directly, use the DNS lookup.

Frequently asked questions

Is SSL the same as TLS?

TLS is the modern version of SSL. Every secure website today uses TLS, but most people still say "SSL certificate", so we use both terms.

How often should I check my certificate?

Free certificates last about 90 days. Check after every renewal, or whenever visitors report a browser warning. Many certificate authorities also email you before a certificate expires.

Why does the checker show a different expiry date than my browser?

Your server may hold more than one valid certificate, or a CDN such as Cloudflare may present its own certificate in front of your server. The browser shows the certificate it received; we show the newest one recorded in the public logs.

Do you store the domains I check?

No. The domain is used for the lookup and is not saved. Results from the public logs may be cached for up to an hour to keep the tool fast.

Last updated October 20, 2026 by the FindMyIPLocation team.