Domain Health · SSL/TLS
SSL certificate checker
Makes a real HTTPS connection to the hostname and reads the newest certificate from public Certificate Transparency logs, so you know whether it works today and how long it has left.
Check the exact hostname
Certificates are issued for specific names. yourdomain.com and www.yourdomain.com can have different certificates, and one can work while the other fails. Check each name people actually visit.
Why certificates still expire
Most hosts renew free certificates automatically about 30 days before expiry, but renewal silently fails surprisingly often: DNS moved to a new provider, a validation file got blocked, a payment card on a paid certificate expired, or a server was migrated and the renewal job didn't come with it. An expired certificate puts a full-page browser warning in front of every visitor.
What to do if the connection fails
- Expired: renew it at your host or certificate provider, then find out why automatic renewal didn't run.
- Wrong name: the certificate doesn't cover this hostname. Reissue it with every name you serve (for example both the bare domain and www).
- Self-signed or incomplete chain: install a certificate from a public authority and include the intermediate certificates your provider supplies.
- No HTTPS at all: the server isn't listening on port 443. Most hosts offer free certificates; turn HTTPS on in the hosting panel.
How we read expiry: Certificate Transparency logs record every publicly trusted certificate. We show the newest one issued for this hostname. In rare setups a server keeps serving an older certificate; the connection test above catches that once it actually expires.
Agency plans and up monitor certificates and alert you 30, 14, 7, 3 and 1 days before expiry.