When does your certificate
expire?
Expiry date, the full chain with intermediates, hostname coverage and protocol configuration. Every finding in plain English, with the fix for anything that’s wrong.
Decode an internal / air-gapped certificate
stays in your browserEverything that makes a certificate valid
“Is my SSL OK?” is really four questions. We answer all of them in one pass.
Expiry date
The #1 cause of certificate outages. We show the exact date, the days left, and how far through its life the cert is.
The full chain
Leaf, intermediates, root. Browsers forgive a missing intermediate — curl, Android and payment APIs don’t.
Hostname coverage
Does the certificate actually cover the name you serve? SANs and wildcards checked against your host — www included.
TLS configuration
Which protocol versions answer, whether legacy TLS 1.0/1.1 is off, HSTS, OCSP stapling — the settings behind the padlock.
What that browser error actually means
Every scary full-page warning maps to one specific certificate problem — and one specific fix.
The certificate is expired — or not valid yet. A wrong clock on the visitor’s device does it too, but start by renewing.
The browser can’t trace the certificate to a trusted root — self-signed, or the server isn’t sending its intermediate.
The certificate is fine — for a different name. The host you’re serving isn’t in the SANs (classic: www missing).
Firefox’s version of a broken chain. Firefox is stricter than Chrome about fetching missing intermediates itself.
The umbrella warning. Click Advanced to reveal the real error code underneath — then match it to this list.
The signature of a missing intermediate. Desktop Chrome quietly downloads it; older Android and strict clients refuse.
Not just websites on 443
Certificates live everywhere — and the ones nobody looks at are the ones that expire unnoticed. Point the checker at:
- Mail servers — SMTPS :465, IMAPS :993, POP3S :995 (TLS from the first byte; STARTTLS ports like :587 upgrade mid-session and won’t answer)
- Admin panels & APIs — :8443 and friends
- Bare IPs — with an SNI hostname when one IP serves many certs
- Internal certs — we can’t reach your intranet, so paste the PEM and we decode it right in your browser. Nothing is uploaded.
Examples
host : portThe openssl cheatsheet, decoded.
Every check this page runs has a command-line equivalent. Here’s the crib sheet — we just run all of them at once and translate the output.
Common questions
Type your domain above — the verdict leads with the exact expiry date and days remaining, plus a timeline showing how far through its life the certificate is. To stop checking by hand, leave your address on the result: we re-read that one certificate daily and email you 30, 14, 7 and 1 day out, no account needed. For a set of certificates with a lead time you choose, that's SSL monitoring.
Your server is probably sending only its own certificate, without the intermediate that links it to a trusted root. Desktop Chrome fetches the missing piece on its own; most other clients don't. The fix is one line: serve the full chain (for example fullchain.pem instead of cert.pem).
Yes — set the port field to 465 or 993 for mail, 8443 for an admin panel, or any other port that speaks TLS from the first byte. Ports that start in plain text and upgrade with STARTTLS (587, 25, 143, 110) are the exception: the check opens a direct TLS connection, so those won't answer. You can also check a bare IP and supply an SNI hostname when one address serves several certificates.
A public checker can't reach 10.x addresses — but you don't need it to. Paste the PEM and we decode it entirely in your browser: subject, SANs, issuer, expiry, key. The certificate never leaves your machine.
Cryptographically, no — browsers trust Let's Encrypt, Sectigo, GlobalSign and the rest equally. The practical difference is the 90-day lifetime: auto-renewal fails silently — a stopped cron, a moved webroot, a new firewall rule — which is why expiry monitoring matters more with free certs, not less.
Chrome: click the padlock (or tune icon), then "Connection is secure", then "Certificate is valid". Safari: padlock, then "Show Certificate". Firefox: padlock, then "Connection secure", then "More information". You'll see the same fields this tool shows — minus the chain validation and the verdict.
Free, no sign-up. Every result has a permanent share link and an SVG status badge you can embed in a README or dashboard. And if what you actually want is "tell me before anything expires", that's Uptimia's SSL monitoring. It starts with the paid plans — one certificate on Basic, 10 on Professional, 100 on Enterprise — and the 30-day trial includes it in full, 50 certificates, no credit card.
Free tools are just the start.
Uptimia keeps your sites healthy.
Uptime, SSL, domain expiry, page speed, transactions — monitored from 171+ locations worldwide. Free for 30 days.