SSL Certificate Checker
Check the certificate on any website or mail server: when it expires, who issued it, which names it covers, whether the chain is complete and trusted, how strong the key is, and which TLS versions the server still accepts.
- Chain and trust
- Expiry warnings
- Mail servers too
Certificates are getting shorter
- Browsers and certificate authorities agreed to cut the maximum lifetime of public certificates: 200 days from 15 March 2026, 100 days from March 2027 and 47 days from March 2029.
- Renewing by hand won't keep up. Use automatic renewal (ACME, as Let's Encrypt, Plesk, cPanel and most hosts do) and monitor expiry.
- Let's Encrypt certificates already last 90 days and renew automatically around 30 days before expiry. If one has less than 20 days left, renewal has probably failed.
Common problems
- Incomplete chain: the server must send the intermediate certificate(s) as well as its own. Browsers often cope, but apps, APIs and mail servers fail.
- Name mismatch: the certificate must list the exact name, or a matching wildcard (*.example.co.uk covers www.example.co.uk but not example.co.uk itself).
- TLS 1.0 and 1.1 are retired and fail Cyber Essentials Plus and PCI scans. Turn them off; keep TLS 1.2 and 1.3.
- CAA records in DNS say which authorities may issue certificates for your domain, which blocks mis-issuance.
- Check the site's HSTS and security headers with the HTTP Header Checker.