SSL Certificate Checker: Expiry, Issuer and a Live HTTPS Probe
This checker answers the two questions people actually come here with: when does the certificate expire, and does HTTPS work right now? It reads the domain's certificate history from public Certificate Transparency logs — every certificate a public CA issues is published there — and separately opens a live HTTPS connection to confirm the site is reachable over TLS today.
SSL/TLS certificates encrypt data between browsers and servers. An expired or misconfigured certificate causes browser warnings and can damage user trust and SEO rankings — and expiry is by far the most common way a working site breaks overnight.
What We Check
Expiration Date: When the current certificate expires, and how many days remain.
Issuer: The Certificate Authority (CA) that issued it.
Covered Names: The domains and wildcards listed on the certificate.
Revocation Flag: Whether the transparency log records the certificate as revoked.
Certificate History: The most recent certificates issued for the domain, with their validity windows.
DNS Resolution: Whether the hostname resolves to an A or AAAA record.
Live HTTPS Probe: Whether an HTTPS request to the host succeeds, and the status code it returns.
What We Cannot Check — And Why
This tool runs on Cloudflare Workers, and the Workers runtime does not expose the peer certificate or the negotiated connection parameters to the code making the request. That rules out several things you may have seen other checkers report:
TLS version and cipher suite: not available — we cannot tell you whether the handshake used TLS 1.2 or 1.3, or which cipher was negotiated.
Key type and size: not available — no 2048-bit or 4096-bit readout, and no signature algorithm.
Certificate fingerprints and serial numbers: not available.
Chain inspection: we cannot show you the intermediate certificates the server actually sends. What we can say is narrower but still meaningful: if the HTTPS probe succeeds, the edge client accepted the chain and hostname, so the certificate validated against a standard trust store at that moment.
One more limitation worth stating plainly: the certificate details come from transparency logs, not from your server. If a host is serving an old certificate, or a self-signed one that was never logged, the CT data will not reflect that. Read the CT panel as "what has been issued for this domain" and the probe as "does TLS work right now" — together they catch expiry and outages, which is most of what goes wrong. For a full handshake audit, use openssl s_client -connect example.com:443 or SSL Labs' server test.
Why SSL Matters
Security: Encrypts data in transit, protecting passwords and sensitive information.
Trust: The padlock icon shows visitors your site is secure.
SEO: Google uses HTTPS as a ranking signal—secure sites rank higher.
Compliance: Required for PCI DSS, HIPAA, and other regulations.
Certificate Expiry Guidelines
🟢 >90 days: Certificate is healthy, no action needed.
🟡 30-90 days: Start planning renewal.
🟠 7-30 days: Renew soon to avoid disruption.
🔴 <7 days: Critical—renew immediately.
❌ Expired: Users will see security warnings.
FAQ
What's the difference between SSL and TLS?
TLS (Transport Layer Security) is the successor to SSL (Secure Sockets Layer). SSL is deprecated, and modern "SSL certificates" actually use TLS. The term "SSL" persists due to familiarity.
Why did the HTTPS probe fail?
A failed probe means our edge client could not complete an HTTPS request to the host. The usual causes are an expired certificate, a domain mismatch (the certificate was issued for a different name), a self-signed or untrusted certificate, missing intermediate certificates in the chain, or simply a host that is down or blocking our request. The probe cannot tell you which of those it was — it reports success or failure, not a reason.
Where does the certificate data come from?
From public Certificate Transparency logs, via Cert Spotter's issuance API. CT is a public, append-only record that browsers require CAs to publish to; every certificate a public CA issues shows up there within hours. It is not a live read of what your server is sending, which is why this page separates the CT panel from the HTTPS probe.
Can it check an internal or self-signed certificate?
No. Internal CAs and self-signed certificates are not published to transparency logs, so nothing will appear in the certificate panel, and a host that is not reachable from the public internet will fail the probe. This tool only works for publicly resolvable domains with publicly issued certificates.