SSL Checker

An SSL certificate is what lets a browser show the padlock and connect over https:// instead of plain http:// - it proves a site is who it claims to be and encrypts everything sent to and from it. This checker looks at the certificate a domain is actually presenting right now, not what should be there.

Certificate validity

Whether the certificate parses correctly and hasn't already expired. An invalid certificate is a hard stop in every major browser - there's no "proceed anyway" link, visitors just get blocked.

Domain match

The certificate has to list the exact hostname being checked, or a wildcard that covers it, in its Subject Alternative Names. A certificate issued for www.example.com but served on example.com fails this check even though the certificate itself is otherwise fine.

Chain of trust

A certificate is only trusted because it was signed by a Certificate Authority whose own root certificate already ships in browsers and operating systems. A self-signed certificate, or one missing the right intermediate, breaks that chain and gets the same warning an expired certificate does.

Expiration

Certificates are issued for a fixed period - 90 days is now common, since automated renewal (Let's Encrypt and similar) made short lifetimes practical. A certificate that's expired, or close to it, is the single most common reason a working site suddenly starts throwing security warnings.

This page only covers those four checks, fast. For protocol support, cipher strength, HSTS, and certificate revocation, see SSL Analyzer.