SSL certificate checker
See the latest SSL certificate issued for a domain: who issued it, when it expires, and which names it covers. Reads public certificate logs only.
Related guides
SSL certificate validity 47 days
SSL certificates are moving to 47 days: what MSPs should tell clientsThe CA/Browser Forum schedule, why it is happening, and why manual renewals stop being viable for client websites.
CAA record explained
CAA records explained: limit who can issue your SSL certificatesA small DNS record that tells certificate authorities who is allowed to issue for a domain, with examples and the one mistake to avoid.
Guide
Website security headers explained for small business sitesEach header in plain English, a safe starting value, how to add it on common hosts, and how to avoid breaking the site.
How the certificate check works
The checker reads public certificate transparency logs through Cert Spotter, with crt.sh as a fallback. It does not connect to the website, so a certificate installed on a different server can show here. See why certificate lifetimes are getting shorter.
Frequently asked questions
Where does this certificate data come from?
From public certificate transparency logs, which record every publicly trusted certificate when it is issued. The latest one logged for the domain is normally the one in use. The tool does not connect to the server.
Why does a certificate show as expiring soon?
It has fewer than 30 days left. Certificates from automated authorities are renewed about every 90 days, so an old date usually means a manual certificate nobody renewed.
What is a wildcard certificate?
A certificate for *.example.com, which covers every one-level subdomain. It is convenient, but one leaked key exposes all of them, so a wildcard is worth knowing about.