The padlock in a browser’s address bar depends on one small file: the site’s SSL certificate. When it is valid, visitors see nothing unusual. When it has expired, covers the wrong name or was never set up properly, browsers show a full-page warning that most people will not click past. The checker above connects to a site the same way a browser does, reads its certificate and tells you whether browsers will trust it, when it expires and what to fix if something is wrong.

What an SSL Certificate Does

An SSL certificate does two jobs. It lets the browser and the website encrypt everything they send each other, so passwords, card numbers and form entries cannot be read along the way. And it proves the site is really the one named in the address bar, because a trusted company called a certificate authority checked that the site’s owner controls the domain before issuing it.

The technology is now called TLS, short for Transport Layer Security, which replaced the original SSL years ago. Everyone still says SSL certificate, so we do too. Any site that loads over https:// is using one.

What This Tool Checks

Each check connects to the site on port 443, the standard port for secure websites, and reads the certificate the server sends. It then tests that certificate against the same list of trusted authorities that browsers use and reports:

• Whether the certificate is trusted, and if not, the exact reason
• The names it covers, and whether the domain you entered is one of them
• Who issued it, and the dates it is valid from and until
• The type and size of its key and the signature it uses
• The TLS version the server agreed to use
• The full chain of certificates, from your site up to the authority that issued it

How to Read Your Results

The top of the result gives a one-line verdict. A green “Valid certificate” means browsers will show the padlock without complaint. An amber warning means the certificate works today but needs attention soon, usually because it expires within two weeks. A red verdict means visitors are already seeing a warning or an error.

Below the verdict, each detail has a colored dot. Green means it is fine, amber means it is worth a look and red marks the problem. When something needs fixing, a What to Fix box explains the change to make, in steps you can pass to your host or developer.

Common Certificate Problems

Most certificate errors come from a short list of causes, and each one has a simple fix:

• Expired certificate: renewal failed or was forgotten, often after a DNS change broke automatic renewal
• Name mismatch: the certificate covers example.com but not www.example.com, or the other way around, or it belongs to a different site on the same server
• Missing intermediate certificate: the server sends its own certificate without the one that links it to a trusted authority, which breaks many phones and apps even when a desktop browser works
• Self-signed certificate: the server made its own certificate instead of getting one from a trusted authority, which is fine for testing but not for a public site
• No HTTPS at all: the server does not answer secure connections, so the site only loads over plain http

Why the Certificate Chain Matters

Browsers do not trust your certificate directly. They trust a small set of root authorities built into the operating system or browser. Those roots sign intermediate certificates, and the intermediates sign the certificates for individual websites. Your server needs to send both its own certificate and the intermediate, so the browser can follow the chain back to a root it knows.

When the intermediate is missing, some desktop browsers fetch it on their own and the site seems fine. Many phones, older devices, payment systems and other servers do not, so they refuse to connect. That is why a site can look perfect in your browser and still fail for some visitors. The chain section of the result shows exactly what the server sends.

How Long Certificates Last

Certificates are getting shorter-lived on purpose. The industry body that sets the rules for certificate authorities agreed in 2025 to cut the maximum life of a certificate in stages, from 398 days to 200 days in March 2026, then to 100 days in 2027 and 47 days in 2029. Free certificates from Let’s Encrypt already last only 90 days.

Short lifetimes make manual renewal impractical, so automatic renewal is now essential. Most hosting companies renew free certificates on their own. If yours does not, ask how to turn it on, and check your certificate here now and then to make sure renewal is still working.

How to Fix an Expired Certificate

If your certificate has expired, the fastest fix is to renew it through your hosting control panel, where most hosts have a button to issue or reinstall a free certificate. If you bought a certificate from a separate company, renew it there, then install the new files on your server, including the intermediate bundle.

After renewing, run the check again to confirm the new expiry date. If automatic renewal failed, look for the reason before the next deadline. The usual causes are a domain that now points to a different server, a firewall that blocks the authority’s validation request or a CDN in front of the site that handles certificates separately.

SSL and Your Redirects

A valid certificate only helps if visitors actually reach the secure version of your site. If someone types your domain without https://, the server should send them to the https:// address with a permanent redirect. Use the button under each result to check that redirect in our Redirect Checker, which shows every hop between the plain and secure versions.

What Free and Paid Certificates Have in Common

For encryption and the padlock, a free certificate works exactly as well as a paid one. Browsers treat them the same way. Paid certificates can include extra checks on the business behind a site, longer support, warranties or features such as covering many subdomains at once, which matters to some companies. For most websites, a free certificate that renews itself is the right choice.

Your Checks Stay Private

We do not keep a record of the domains you check or anything about who checked them. Each result is held for ten minutes so a repeated check loads quickly, then deleted. The checker only connects to public addresses and never to private networks.