SSL Certificate Checker: Expiry, Coverage and HTTPS Setup
Enter a domain to see who issued its certificate, when it expires, which names it covers and how its HTTPS is set up.
An expired or mismatched SSL certificate turns your site into a full-screen browser warning. Most visitors won’t click past it, and the problem often appears overnight when an automatic renewal quietly fails.
This SSL checker connects to your domain and reads the certificate it serves: the issuer, validity dates and days left, the domain names it covers (SAN), the key and signature algorithm, and the TLS version negotiated. It also checks whether plain HTTP redirects to HTTPS, so you can confirm the whole setup in one place.
How to check an SSL certificate
Enter your domain
Type the host name, such as www.example.com. Check the bare domain and each subdomain separately.
Read the certificate details
See the issuer, expiry date and days left, covered names, key type, signature and TLS version.
Fix and set a reminder
Renew or reissue if needed, make sure HTTP redirects to HTTPS, and keep an eye on the expiry date.
What each result means
- Issuer: the certificate authority (CA), such as Let’s Encrypt, Sectigo, DigiCert or Google Trust Services. Browsers treat a valid certificate from any trusted CA the same way, and so does Google.
- Validity and days left: lifetimes are shrinking. Under CA/Browser Forum rules, publicly trusted certificates issued from March 15, 2026 may be valid for at most 200 days, falling to 100 days in 2027 and 47 days in 2029 (CA/Browser Forum). Manual renewal no longer scales.
- Covered names (SAN): browsers check the Subject Alternative Name list, not the old Common Name. A wildcard such as
*.example.comcoverswww.example.combut notexample.comitself, nora.b.example.com. - Key and signature: RSA 2048-bit or ECDSA P-256 keys with SHA-256 signatures are the norm.
- TLS version: TLS 1.2 and 1.3 are current. TLS 1.0 and 1.1 were formally deprecated by RFC 8996 and are disabled in modern browsers.
Our SSL certificate glossary entry explains the basics.
HTTPS, redirects and SEO
Google has used HTTPS as a lightweight ranking signal since 2014, and Chrome labels plain HTTP pages “Not secure”. The bigger SEO risk is a messy setup: HTTP and HTTPS both answering 200, or an HTTP-to-HTTPS redirect that hops through several URLs. Every HTTP URL should reach its HTTPS twin with one 301, and canonicals, sitemaps and internal links should all use https. Trace the hops with the redirect checker, then add HSTS so browsers stop requesting HTTP at all.
After moving to HTTPS, look for mixed content: images, scripts or iframes still loaded over http. Browsers block mixed scripts outright and upgrade or block mixed images, which can break pages that look fine on your own machine.
Automate renewals and control who can issue
With Let’s Encrypt and certbot, issue one certificate for both names and test that renewal works:
sudo certbot --nginx -d example.com -d www.example.com
sudo certbot renew --dry-runMost hosts and CDNs, Cloudflare included, renew edge certificates automatically; the weak spot is usually the origin certificate or a custom domain added later. A CAA record in DNS limits which CAs may issue certificates for your domain:
example.com. 3600 IN CAA 0 issue "letsencrypt.org"If you switch certificate providers, update CAA first or renewals will fail. Check your records with the DNS lookup.
Tips for trouble-free HTTPS
- Monitor expiry and alert yourself 30 days ahead, with a second reminder at seven days.
- Make sure the certificate covers both the bare domain and www, even if one only redirects to the other.
- Check every subdomain that serves traffic, including shop, mail and API hosts, not just the main site.
- Disable TLS 1.0 and 1.1 on your server and keep TLS 1.2 and 1.3 enabled.
- After a renewal, re-test from outside your network; some servers keep serving the old certificate until they are reloaded.
Limits to keep in mind
The checker reads the certificate your server presents for the host name you enter and tests the HTTP-to-HTTPS redirect. It doesn’t grade cipher suites, test for protocol vulnerabilities or verify every chain path across all clients; for that depth, use Qualys SSL Labs. Each subdomain needs its own check, and mixed content inside pages is easiest to find in the browser’s DevTools console. For HSTS and other protective headers, run the security headers checker.
Last updated Oct 30, 2026 by the Yes SEO team.
SSL Checker: frequently asked questions
How do I check when my SSL certificate expires?
Enter your domain above to see the expiry date and the number of days left. In a browser, you can also click the site information icon in the address bar and open the certificate details.
Is SSL the same as TLS?
TLS is the modern successor of SSL. Every SSL version is deprecated and disabled in browsers, but “SSL certificate” stuck as the everyday name for the certificates used with TLS.
Does a paid certificate rank better than a free one?
No. Google doesn’t distinguish between certificate authorities or validation levels. A free Let’s Encrypt certificate gives the same HTTPS signal as an expensive one, as long as it is valid and trusted.
Why does my certificate work on www but not on the bare domain?
The certificate probably lists only www.example.com among its names. Reissue it to cover both names, or browsers will show a name-mismatch warning on the version that isn’t listed.
Does an expired certificate hurt SEO?
Visitors see a security warning and most leave, and crawlers can run into errors fetching your HTTPS pages until it is fixed. Renew quickly and set up automatic renewal so it doesn’t happen again.
Which TLS version should my server use?
Enable TLS 1.3 and TLS 1.2, and disable TLS 1.0, 1.1 and every SSL version. That matches what current browsers support and what security guidelines recommend.