Free SSL certificate checker

A free SSL certificate checker does more than tell you whether a cert is expired. The meaningful data points are: the exact notAfter date (not just 'valid'), the issuer and CA chain (is it properly chained to a trusted root?), the TLS version negotiated (TLS 1.2 vs 1.3 matters for compliance), the Subject Alternative Names (does the cert actually cover the hostname you checked?), and whether the domain appears in Certificate Transparency logs as expected.

Most online SSL checkers call an external API rather than performing a real TLS handshake. This means they report what the CA issued — not what your server is actually serving. If you renewed your certificate but forgot to reload Nginx, an API-based checker will show the new certificate as valid while your users see a browser warning. CertFleet's free checker performs a genuine TLS handshake from our probe infrastructure and returns the certificate your server presents, not the one on file at the CA.

The probe reads the full X.509 certificate: serial number, validity window, issuer DN, subject, SAN entries, key type, signature algorithm, and chain length. It also checks whether the chain terminates at a trusted root and flags common misconfigurations: a self-signed leaf certificate, a missing intermediate, a chain that includes an expired intermediate (a common failure pattern after CA root rotation), and hostname mismatches between the certificate's SAN list and the requested hostname.

Certificate Transparency cross-referencing adds a security dimension beyond expiry checking. The checker queries CT logs to see whether the certificate is properly logged and whether any additional certificates have been issued for the same domain recently. Finding an unexpected certificate in CT — one you did not issue yourself — is a signal of potential mis-issuance or an attacker using a compromised CA to generate a fraudulent certificate for your domain.

The free checker is useful for quick verification: before and after a deployment, during an incident investigation, or when a colleague reports a browser warning. It requires no login and no credit card. For ongoing monitoring — getting alerted 30/14/7/1 days before expiry, tracking CT log events, and maintaining check history — the free account tier adds continuous monitoring for up to 10 SSL domains and 10 uptime monitors.

Common use cases for a one-off SSL check: verifying a new certificate deployment succeeded and the right cert is being served, checking whether a third-party domain your application depends on is about to expire, investigating a 'connection not secure' report from a user, auditing a batch of domains inherited from another team, and confirming that a staging environment's certificate matches the expected issuer and SAN list.

Automate batch checks via the REST API available from the Starter plan. The API returns the same full certificate report as the checker for any monitored domain, with timestamps and history. Useful for feeding certificate data into an internal dashboard, a SIEM, or a compliance report. Signed webhooks can push certificate events — new issuance, expiry threshold crossed — to any downstream system without polling.

Try the free checker now — enter any domain and get a full TLS report in seconds, no account needed. To monitor that domain continuously and get expiry alerts, create a free account. See the full guide to SSL certificate monitoring for a deeper look at what to watch and why.