SSL Certificate Checker

About this tool

The SSL Certificate Checker looks up the most recently issued public certificate for a domain and reports the issuing authority, the validity dates, the days remaining and every hostname the certificate covers. Paste a bare domain, a hostname or a full URL; the scheme, port and path are stripped before the lookup runs.

It exists to catch expiry before your users do. A lapsed certificate does not degrade quietly — browsers and API clients refuse the connection outright, and the outage lands on whoever is on call. Checking here needs no shell access, so it is a quick way to confirm a renewal or verify SAN coverage. For monitoring across a whole estate, see our cyber security services.

How to use it

Enter a domain and select Check certificate. The result table reads as follows.

• Issuer — the certificate authority that signed it. An unexpected issuer usually means a renewal ran through a different team or automation path.
• Issued and Expires — the start and end of the validity window, shown in UTC.
• Days remaining — red once the date has passed, amber when expiry is close, green otherwise. Treat anything under 30 days as work to schedule.
• Covers — the DNS names the certificate is valid for. A hostname missing from this list will produce a name-mismatch error.

Common questions

Does this tool connect to my server?

No. The lookup runs on our side and reads public Certificate Transparency logs rather than opening a TLS connection to your host. It therefore works for names that are not yet publicly reachable, but it reports the most recently logged certificate rather than the one currently installed. To confirm what a live server is presenting, inspect the certificate on the server itself.

Why does the result differ from what my browser shows?

Transparency logs record issuance, not deployment. If a renewal has been issued but not installed, this tool shows the new certificate while your browser still sees the old one. Private or internal certificates are never submitted to public logs, so they will not appear here at all.

How far ahead of expiry should I renew?

Aim to have the replacement issued and installed at least 30 days before expiry, which leaves room for validation delays and a change window. Public certificate lifetimes keep getting shorter, so where the platform supports it, automated issuance and renewal is more reliable than a manual cycle.