Is this SSL checker free?

Yes. You can run 3 checks a day without creating an account, and the result appears on the page straight away. For daily automatic checks on several sites, Deltio offers a 14-day free trial.

Why does my browser show a padlock when the checker says the chain is incomplete?

Browsers can cache intermediate certificates from sites you visited before, or fetch a missing one themselves, so the page looks fine to you. Other visitors, mobile apps and crawlers often do not do this and get an error. The checker connects from a clean server, so it sees what a first-time visitor sees.

Does the SSL checker test TLS versions or cipher suites?

No. It checks the certificate: whether it is trusted, whether it matches the hostname, its validity dates, the issuer and the names it covers. To audit protocol versions and cipher configuration, use a dedicated server test such as Qualys SSL Labs.

Can I check a subdomain or a port other than 443?

You can check any subdomain by entering its full hostname, for example shop.example.com. The checker always connects on port 443, the standard HTTPS port, so services on other ports cannot be tested here.

How do I get an alert before an SSL certificate expires?

Deltio checks the certificate of every monitored site and sends an email or Slack alert 30 days and 1 day before it expires, plus an immediate alert if it becomes invalid. Plans start at £24 a month, or £20 a month billed annually, with a 14-day free trial.

← Free website tools

Free SSL checker

Check any website's SSL certificate in seconds: validity, expiry date, days left, issuer and the domains it covers. Free, with no sign-up.

What this SSL checker tests

When you enter a domain, our server opens a TLS connection to it on port 443, the same handshake a browser performs before loading a page. It reads the certificate the server sends back and checks three things: that the chain leads to a certificate authority browsers trust, that today's date falls inside the validity period, and that the certificate covers the exact hostname you typed. Paste a full URL if that is easier. Only the hostname is used and the path is ignored.

The check runs from our server, not from your browser. That difference matters more than it sounds. Your browser may have cached an intermediate certificate from an earlier visit and show a padlock on a site whose chain is actually broken for other visitors, for API clients and for crawlers.

How to read the result

A valid result means all three checks passed. Underneath you will see the expiry date and the days left, the issuer (usually the CA's organisation name, such as Let's Encrypt, Sectigo, DigiCert or Google Trust Services), the date the certificate became valid, and the names it covers.

Those names come from the Subject Alternative Name (SAN) field, and the list deserves a proper look. A certificate for example.com does not automatically cover www.example.com. A wildcard like *.example.com covers shop.example.com, but not example.com itself and not a.b.example.com. If a client runs a subdomain you had forgotten about, it may sit on a different certificate altogether, so check it separately.

The "valid from" date is useful too. Let's Encrypt certificates last 90 days and certbot renews them by default when 30 days are left. If a Let's Encrypt certificate was issued well over 60 days ago, automatic renewal has probably stopped working.

What each error means and how to fix it

Expired certificate

The validity period is over. Browsers show a full-page warning and most visitors turn back. On sites using free certificates this nearly always means automatic renewal failed. Check the renewal job (certbot, the hosting panel or the CDN), and look for a DNS change or a firewall rule that blocks the validation request. Then renew and reload the web server.

Hostname mismatch

The certificate is valid, just not for this name. Typical causes are a missing www entry in the SAN list, a domain pointing at a shared server that answers with another site's certificate, or a new domain added to a site without reissuing the certificate. Reissue it with every hostname you actually serve.

Self-signed certificate

The server signed its own certificate instead of getting one from a trusted CA. Acceptable on a staging server, never on a public site. It often shows up after a server rebuild, when the default certificate from the control panel or web server is still in place.

Untrusted or incomplete chain

The server sends its own certificate but not the intermediate that links it to a trusted root. Desktop browsers can sometimes work around this; many mobile apps, payment and API integrations and crawlers cannot. The fix is to serve the full chain. On nginx with certbot, that means pointing ssl_certificate at fullchain.pem, not cert.pem.

No HTTPS response on port 443

Nothing answered on port 443. The domain may not resolve, the server may be down, a firewall may be dropping the connection, or the site may only serve plain HTTP. Check DNS first, then whether the site loads at all. If it is down, our piece on whether downtime hurts SEO explains what to expect from Google.

A warning instead of an error means the certificate is valid but expires within 30 days. With automatic renewal, this is often the window in which it happens, so check again in a few days. If the certificate is renewed by hand, book the renewal now.

Why a one-off check is not enough

A certificate that is fine today can fail next month, and usually nobody looks until a client rings. Lifetimes are getting shorter as well. Since March 2026 a publicly trusted certificate can be valid for at most 200 days, dropping to 100 days in March 2027 and 47 days in 2029. More renewals mean more chances for one of them to fail unnoticed.

The failures that cause trouble are rarely the planned ones. A hosting migration leaves the old certificate behind, a CDN gets switched on for one subdomain, a renewal job stops after a server update. Domain registrations fail the same way on a yearly cycle, which we cover in domain expiry monitoring.

For a single site, a calendar reminder and this page might be enough. For twenty client sites on different hosts, it is not.

Automatic certificate checks with Deltio

Deltio checks the SSL certificate of every site you monitor, alongside uptime, sitemaps, SEO tags, robots.txt and domain expiry. It sends an email or Slack alert 30 days before a certificate expires, again 1 day before, and straight away if the certificate stops being valid. The setup is described in SSL certificate expiry monitoring. Plans start at £24 a month, or £20 a month billed annually, and there is a 14-day free trial.

This free checker allows 3 checks a day, shows results on the page and needs no account.

Frequently asked questions

Is this SSL checker free?: Yes. You can run 3 checks a day without creating an account, and the result appears on the page straight away. For daily automatic checks on several sites, Deltio offers a 14-day free trial.
Why does my browser show a padlock when the checker says the chain is incomplete?: Browsers can cache intermediate certificates from sites you visited before, or fetch a missing one themselves, so the page looks fine to you. Other visitors, mobile apps and crawlers often do not do this and get an error. The checker connects from a clean server, so it sees what a first-time visitor sees.
Does the SSL checker test TLS versions or cipher suites?: No. It checks the certificate: whether it is trusted, whether it matches the hostname, its validity dates, the issuer and the names it covers. To audit protocol versions and cipher configuration, use a dedicated server test such as Qualys SSL Labs.
Can I check a subdomain or a port other than 443?: You can check any subdomain by entering its full hostname, for example shop.example.com. The checker always connects on port 443, the standard HTTPS port, so services on other ports cannot be tested here.
How do I get an alert before an SSL certificate expires?: Deltio checks the certificate of every monitored site and sends an email or Slack alert 30 days and 1 day before it expires, plus an immediate alert if it becomes invalid. Plans start at £24 a month, or £20 a month billed annually, with a 14-day free trial.