Trust and validity
We check that the certificate was issued by an authority browsers trust, that it is issued for the hostname you typed, and that it has not expired or is not about to.
Free SSL certificate checker
See whether a site’s certificate is trusted, who issued it, when it expires and what would make browsers show a warning.
- Trust, hostname and expiry checks
- Full certificate chain
- TLS version and cipher
- HTTP to HTTPS redirect test
*We connect to the site live and read only its certificate; nothing is stored
What the SSL checker looks at
The certificate chain
Browsers need the intermediate certificate to connect your certificate to a trusted root. If the server does not send it, some phones and apps fail even when desktop browsers work.
Protocol and key strength
We record which TLS version and cipher the server negotiated and how strong the key is, and test whether plain http:// redirects to https:// so every visitor gets the padlock.
Found a problem? We can fix it.
Most SSL warnings come down to one of these, and every one is covered on our hosting:
Free SSL on every plan
Every hosting plan includes a trusted certificate that is installed and renewed automatically, so the padlock is always there.
Complete chains
Intermediate certificates are served correctly on our servers, so phones, apps and browsers all verify your site without errors.
Automatic renewal
Certificates renew on their own weeks before expiry. If you prefer a paid OV or EV certificate, we remind you and can renew it for you.
HTTPS by default
Plain http:// redirects to https:// out of the box, with TLS 1.2 and 1.3 and strong ciphers enabled.
Help when you need it
Our engineers look at chain, hostname and redirect problems every day and will fix yours by chat or ticket, around the clock.
SSL checker FAQ
It opens a secure connection to the domain you enter, exactly as a browser would, and reads the certificate the server presents. It then runs the same checks a browser runs: is the issuer trusted, does the name match, is it within its validity dates, is the chain complete. It also notes the TLS version, cipher and key size, and whether the plain http:// address redirects to https://.
Read the reason under the check. A self-signed certificate must be replaced with one from a real authority (every hosting plan with us includes a free one). A missing intermediate means the server is only sending your certificate and not the CA bundle: install the full chain. An expired certificate needs renewing.
The certificate was issued for a different name, for example for example.com but you typed www.example.com, or the other way round. Most certificates cover both, but not all. Reissue the certificate with every hostname you use, or use a wildcard certificate.
Certificates from Let’s Encrypt are valid for 90 days and are meant to renew automatically, so “expires in 30 days” is normal for them. If the date keeps getting closer without renewing, auto-renewal has stopped; check the cron job or your control panel’s SSL section.
Domain validated (DV) certificates prove control of the domain only. Organisation validated (OV) certificates also verify the company behind the site, and extended validation (EV) certificates go through the strictest vetting. All three encrypt equally well; OV and EV add verified identity for visitors who look.
TLS is the protocol that does the encrypting; SSL is its older name. Versions 1.0 and 1.1 are deprecated and blocked by modern browsers, so the server should offer 1.2 and 1.3. Our hosting does by default.
Many visitors type your address without https://. If the plain version answers without redirecting, they browse the unencrypted site and never see the padlock. A single redirect rule fixes it and also helps SEO, since search engines treat the two versions as one site.
No. We connect, read the certificate, show you the result and drop the connection. Nothing is saved or linked to you.
