SSL certificate check
Enter a domain and we will tell you how long the certificate is valid, who issued it, whether it covers your name and whether a browser will actually accept it. We also catch the two things that remove the padlock despite a perfectly good certificate: resources loaded over http and a missing redirect to https.
What exactly we check
- Expiry date and the number of days left
- Issuer and the names the certificate covers
- Chain of trust: whether a browser accepts the certificate without a warning
- A match against your domain and against the www variant
- TLS protocol version
- Enforced https and resources loaded over http on the home page
We look for http resources on the home page. A subpage may have its own, which cannot be seen from here.
How to read the result
The certificate has expired
Browsers show a full-screen warning that most visitors will not click through. If the certificate comes from a free issuer, check the automatic renewal first: it is almost always the renewal that stopped, not the certificate that expired on its own.
The certificate does not cover this name
The usual cause is a wildcard certificate. "*.yourcompany.com" covers "www.yourcompany.com" but covers neither "yourcompany.com" itself nor "shop.dev.yourcompany.com". The certificate has to list both names you actually use.
The browser will not trust the certificate
A certificate can be valid and still be rejected: the server fails to send the intermediate link of the chain. The symptom is misleading, because on a machine that already knows that intermediate certificate the site opens normally, while on a customer’s phone it does not.
The padlock disappears despite a valid certificate
The page loads an image, script or stylesheet over http. Browsers block such resources and remove the padlock. The fix is in the resource addresses, not in the certificate.
There is a certificate, but nothing enforces https
An http request stays on http, so a contact form can be read in transit. The redirect is a single rule in the server configuration.
Most common causes
Automatic renewal has stopped
Renewal often breaks after a server change, a site migration or a blocked validation directory. You find out on the expiry day itself, usually at night or over a weekend.
A certificate for one name only
A certificate issued for "yourcompany.com" alone throws a warning at everyone who types the address with www.
A hosting change without moving the certificate
The new server presents its own certificate, often the hosting provider’s default one, which has nothing to do with your domain.
Questions and answers
Do you check certificates on subpages?
A certificate covers a host name rather than individual pages, so the result applies to the whole domain. Separate subdomains (shop.yourcompany.com, for instance) have their own certificates and need their own check.
What does "untrusted" mean for a valid certificate?
That the chain up to a trusted issuer is incomplete, or that the certificate is self-signed. A browser treats this the same way as a missing certificate.
Will you warn me before it expires?
Yes, that is part of the free plan. We watch the expiry date and write to you before the certificate expires, not after.
My certificate expires every three months. Is that normal?
Yes, short validity periods are the standard today. The condition is working automatic renewal, and it is the failure of that renewal, not the certificate itself, that causes most incidents.
You checked once. We check every five minutes.
The free plan watches your home page, the SSL certificate and the domain expiry date. No card, no expiry date on the plan itself.
- A pulse check every 5 minutes, with a second check confirming an outage
- A warning before the certificate and the domain expire
- Email notifications with no limit
- Seven days of statistics, one account
How we watch this day to day: Availability monitoring ›
Other tools
Is my website down
Check from the outside whether the site responds, and whether the problem is on your end.
Domain expiry
When the domain expires, who the registrar is and whether anyone can move it without your knowledge.
SPF, DKIM and DMARC
Why your email lands in spam, and whether someone can send invoices from your address.
Security headers
Eight items you set on the server in a quarter of an hour, and every audit asks about them.