// SSL CHECKER
SSL certificate checker
Checks your certificate's validity and expiry, then inspects the security headers your server sends.
What this measures
This check connects to your domain over HTTPS and inspects what a browser checks first: the certificate's validity and expiry countdown, the full issuer chain (including the missing-intermediate problem that breaks phones but not desktops), which TLS protocol versions the server accepts, key strength, whether the certificate covers both the bare domain and www, and six security headers — condensed into an A–F grade in seconds.
How to read your result
- Validity and expiry
- Whether browsers trust the certificate right now, and how many days remain. We flag anything within 21 days of expiry — modern certificates renew automatically, so a short countdown usually means the automation is broken, not that renewal is merely due.
- The A–F grade
- A deliberately simple, deterministic rubric — not a clone of a full SSL Labs scan. Every grade below A lists the exact reasons: an invalid or expired certificate is an F, an incomplete chain or weak key caps you at C, legacy protocols, missing TLS 1.3, or missing HSTS cap you at B.
- The certificate chain
- Browsers trust your certificate through a chain: your certificate, an intermediate, and a trusted root. The chain view shows each link. If the server sends the certificate without its intermediate, some devices fill the gap silently and others fail — the classic "works on my computer, broken on phones".
- The protocol scan
- We attempt a real handshake at each TLS version, 1.0 through 1.3. TLS 1.0 and 1.1 are formally deprecated (RFC 8996) and should be off. TLS 1.2 is still an acceptable baseline; TLS 1.3 is the current best — faster by a full round trip and stricter about weak cryptography.
- Coverage and headers
- The coverage row shows whether the certificate names both your bare domain and www — missing one breaks whichever variant visitors type. The header list checks six security headers, most importantly HSTS, which stops browsers from ever trying plain HTTP.
Common causes & fixes
- Expired certificate
- Browsers show a full-page warning and visitors leave. Renew now, then find out why automation failed — with the industry maximum now 200 days and shrinking, manual renewal is no longer a workable plan.
- Incomplete chain
- The server is not sending the intermediate certificate. Install the full chain (with Let's Encrypt tooling, use fullchain.pem rather than cert.pem; on control panels, paste the CA bundle into its own field) and the phones-only errors disappear.
- Legacy TLS still enabled
- TLS 1.0 and 1.1 offer no benefit — every browser released since roughly 2014 speaks 1.2 — and leaving them on fails compliance scans like PCI-DSS. Disable them in your web server or hosting panel's TLS settings.
- Certificate does not cover www (or the bare domain)
- A certificate for example.com does not automatically cover www.example.com, or the reverse. Reissue with both names listed — free certificates handle multiple names without any extra cost.
Frequently asked questions
How long can an SSL certificate be valid?
Public certificates issued since March 2026 are capped at 200 days, down from the previous 398. The CA/Browser Forum has scheduled further cuts — 100 days in 2027 and 47 days by 2029 — so automated renewal is becoming mandatory in practice, not just good hygiene.
Is TLS 1.2 still safe, or do I need 1.3?
A well-configured TLS 1.2 is still considered acceptable. TLS 1.3 is worth enabling alongside it: the handshake is one round trip shorter, so every new connection is faster, and it removes the weak options 1.2 still permits. Only TLS 1.0 and 1.1 are formally deprecated.
Why does my site work on desktop but show certificate errors on phones?
Almost always an incomplete chain. Desktop browsers often cache intermediates from other sites or fetch the missing link themselves; many mobile and older devices do neither, so only they see the error. This check detects that case directly — look at the chain section.
Are free certificates worse than paid ones?
No — a certificate from Let's Encrypt provides the same encryption and the same browser padlock as a paid one. Paid products differ in things like warranties and organization validation, not in security. What matters is the configuration this check grades: a complete chain, modern protocols, and renewal that never lapses.
Related guides