SSL Checker
Check any site's SSL certificate and TLS configuration in seconds. We read the public certificate — expiry, chain, hostname match — and the negotiated protocol, then give you a plain-English fix for every problem found. Free, passive, no signup.
This tool reads the public certificate the server already presents to every visitor. It performs no intrusive testing and only scans domains you point it at.
What this checker looks at
Every browser runs the same checks before it trusts an HTTPS connection, and any one of them failing produces a security warning that blocks your visitors. This tool surfaces them directly: whether the certificate is currently valid (not expired or not-yet-valid), whether it was issued by a publicly trusted authority with a complete chain, whether it actually covers the hostname you entered, and which TLS protocol versions the server negotiates. It reports configuration facts — it does not infer a vulnerability or CVE from a version banner, because guessing a CVE from a version string is a common source of false alarms.
How to read the result
The grade is a quick summary of the certificate and protocol state; the findings below it are what matter. Each finding pairs a plain-English explanation with a direct link to a step-by-step fix guide for that exact problem. Work top-down — anything marked fail is actively blocking visitors and should be fixed first. After you deploy a fix, re-run the check to confirm it took effect on the live server (a common trap is renewing a certificate but forgetting to reload the web server or CDN).
Common SSL problems and where to fix them
- Certificate expired →
- NET::ERR_CERT_DATE_INVALID →
- Untrusted issuer / missing chain (NET::ERR_CERT_AUTHORITY_INVALID) →
- Your connection is not private →
- ERR_SSL_PROTOCOL_ERROR →
- This site can't provide a secure connection →
- SSL handshake failed →
New to SSL/TLS errors? Start with the complete guide to SSL/TLS errors →
Frequently asked questions
Is this SSL check free?
Yes — it is completely free and open, with no account, no email, and no signup. Enter a domain and you get the certificate and TLS result immediately. The check is passive: it reads the public certificate the server already presents to every visitor, exactly the way a browser does during the TLS handshake. There is nothing to install and no access to your server required. If you want a deeper look across every page, subdomain and open service, the full external scan is also free and is run on request.
Do you store my domain or results?
No. The result is generated for your request and rendered in your browser only; it is not saved to a public page and is not indexed by search engines. The response is explicitly marked no-store and noindex. You can re-run the check any time to get a fresh read — useful right after you renew a certificate or change your TLS configuration, to confirm the fix actually took effect on the live server.
Is the scan safe — will it affect my server?
It is safe and passive. Checking a certificate is equivalent to a single ordinary HTTPS connection — the same thing that happens every time someone visits the site in a browser. It performs no intrusive testing, sends no malicious input, and places no meaningful load on the server. Reading a public certificate is something any visitor's browser already does automatically, so there is no impact on your site or its performance.
Why does the result differ from what my browser shows?
A few reasons. Your browser caches intermediate certificates it has seen before, so a site with a missing intermediate can look fine to you but fail for first-time visitors — this checker reports the chain as actually served. Your device clock also affects date errors locally. And browsers differ in which TLS versions and ciphers they accept. The checker reports the server's real configuration, which is the source of truth for what other visitors experience.
Related tools
Check every page, subdomain and service — free.
The full external scan goes beyond a single certificate: subdomains, open services, and known-exploited vulnerabilities, run under your authorization.