Free SSL certificate checker

What does this checker look at?

Your SSL certificate is what makes the padlock appear in the browser. It proves your website belongs to your domain, and it allows the connection between your visitor and your site to be encrypted.

When you enter your domain, the checker opens an HTTPS connection to your website, the same way a browser does, and reads the certificate your server presents. It reports:

• Whether browsers trust it. To be trusted, the certificate has to come from a recognized certificate authority, match your domain name, and be presented with a complete chain.
• Who issued it, such as Let's Encrypt, Google Trust Services or Sectigo. This helps you work out where it's managed.
• When it expires, shown as a date and the number of days left.
• Which TLS version the connection uses. TLS 1.2 and 1.3 are current, while TLS 1.0 and 1.1 have been formally deprecated.

How do I read my results?

Valid means your certificate is trusted, matches your domain, and has at least three weeks left. If your host renews automatically, you shouldn't need to do anything.

Expiring soon means your certificate is still valid but expires within three weeks. It isn't an emergency yet, but check that automatic renewal is switched on. Renewals sometimes fail without anyone noticing, often because of a DNS or domain setting.

Needs attention or Expired means one of these was found:

• The certificate has expired. Visitors see a full-page browser warning, and many will leave.
• It expires within a week. We flag this as urgent because there's little time left for a failed renewal to be fixed.
• Browsers don't trust it. This can happen when the certificate is for a different name, is self-signed, or is missing part of its chain. Visitors see a security warning even though a certificate exists.

For the encryption version, Modern means your connection used TLS 1.2 or 1.3. If your server still accepts TLS 1.0 or 1.1, the full scan marks it Worth improving. If the connection itself used an older version, that Needs attention.

If you see Couldn't check, we couldn't complete an HTTPS connection. Check that the address is right and that your site is online, then try again.

How do I fix common problems?

Most hosts and website builders include free certificates and renew them automatically. When something goes wrong, the fix is usually in your hosting dashboard.

• If your certificate is expired or expiring, open your host's SSL or TLS settings and use the renew or reissue option, then make sure auto-renew is on. Our guide to what to do when an SSL certificate expires walks through cPanel, Cloudflare and common website builders.
• When the certificate isn't trusted or covers the wrong name, reissue it so it covers every name your site uses, such as both yourbusiness.com and www.yourbusiness.com. On Squarespace, Wix or Shopify, an untrusted certificate usually means the domain isn't fully connected.
• If the browser says "Not secure", read why your website says Not Secure, which also covers redirects from HTTP to HTTPS.
• To turn off old TLS versions, set the minimum TLS version to 1.2 in your CDN or hosting control panel, or ask your host to do it. It's a routine request.

Once your certificate is healthy, consider adding HSTS, which tells browsers to always use HTTPS for your site. You can check it with the free security headers checker.

Is this check safe to run?

Yes. The SSL checker makes one ordinary HTTPS connection to your website and reads the certificate your server already shows every visitor. It doesn't log in, scan ports, or change anything on your server.

Nothing is installed, and you don't need to sign in. Single-check tools like this one don't store the domains you look up. For a saved report covering your certificate alongside the rest of your website and email setup, run the free website security scan.