SSL Certificate Checker URL Parser

Check any website SSL/TLS certificate: validity, days until expiry, issuer, SANs, TLS version, and fingerprints.

SSL Certificate Checker URL Parser tool

Loading...

Example

Input: example.com

Result: Valid SSL Certificate for example.com:443, with issuer, validity dates, days remaining, SANs, TLS protocol (for example TLSv1.3) and fingerprints

The tool opens a TLS connection to port 443 and reads the certificate the server presents. Dates and issuer change whenever the site renews its certificate.

  1. Enter a domain name (such as example.com) or paste a URL into the Domain or Hostname field. Any protocol and path are ignored.
  2. Click "Check SSL Certificate" or press Enter to fetch the certificate from port 443.
  3. Read the status banner to see if the certificate is valid, expired or invalid, and check the days remaining.
  4. Review the subject, issuer and Subject Alternative Names to confirm the certificate covers your hostname.
  5. Check the TLS protocol, cipher suite, key size, serial number and fingerprints, and copy any value you need.

Checking an SSL Certificate and Its Expiry Date

Enter a domain and this checker connects to it on port 443 and reads the SSL/TLS certificate the server sends. It shows whether the certificate is valid, expired or invalid, how many days are left, who issued it and which hostnames it covers.

A certificate counts as valid only if three things are true. It chains to a trusted certificate authority (CA), it matches the hostname you entered, and today falls between its valid-from and valid-to dates. The expiry line is marked Expiring soon at 30 days or fewer and Critical at 7 days or fewer. A certificate that is past its end date, or not yet valid, shows as expired.

The report lists the Subject Alternative Names (SANs), the full set of names the certificate is good for. If your hostname is missing from that list, browsers show a name mismatch warning. You also get the subject and issuer details and the TLS version and cipher suite agreed with our server. The key size, serial number, and SHA-1 and SHA-256 fingerprints complete the report.

Certificates now expire sooner than they used to. Under CA/Browser Forum rules, public TLS certificates issued from March 2026 can last at most 200 days, falling to 47 days by 2029. Renewal is usually automated. A check like this quickly confirms that the new certificate is actually being served.

A browser cannot read the certificate of another site, so this check runs on our server. Your browser sends only the hostname; any https://, path or port you paste is removed first. Private and internal addresses are blocked. To break a full address into its parts, use the URL Parser.

Sources

Frequently Asked Questions

Either it does not chain to a trusted authority or it does not cover the hostname. Self-signed certificates and servers that forget to send the intermediate certificate fail the first test. A certificate for www.example.com used on example.com fails the second. Compare your hostname with the Subject Alternative Names list to spot a mismatch.
Renew with about a third of the lifetime left, and automate it. For a 90-day Let's Encrypt certificate, clients such as Certbot renew when about 30 days remain, which is why this tool warns at 30 days. If a certificate reaches the 7-day Critical mark, check that your renewal job is running and that the web server reloaded the new file.
No. This tool checks port 443 on publicly reachable hosts only, and it blocks private and internal addresses. For an internal server or a custom port, run openssl s_client -connect host:port -servername host from a machine on that network. It prints the certificate chain and the verification result.
A fingerprint is a hash of the whole certificate, so it identifies one exact certificate. Compare the SHA-256 fingerprint here with the one your browser or server shows to confirm they are the same certificate. That helps spot a stale certificate still served by one server behind a load balancer, or an unexpected certificate on the network.
No. Your browser sends only the hostname to our server, which connects to the site on port 443 and returns the certificate details. Paths and query strings are removed before the request is made. Only public hosts can be checked.

Related Tools

URL Encode and Decode

Encode special characters for URLs or decode percent-encoded strings back to readable text.

Developer Tools

IP Address Info

Detect your public IP address and view geolocation data, ISP details, and network information.

Security and Encryption

User Agent Parser

Parse and detect your browser name, version, operating system, device type, and rendering engine.

Security and Encryption

URL Parser

Break down URLs into protocol, host, port, path, query parameters, and hash components.

Developer Tools

HTTP Status Codes Reference

Search and browse over 60 HTTP status codes grouped by class, each with its official name and a plain description.

Web and SEO Tools

JWT Decoder

Decode JSON Web Tokens to inspect header, payload, and signature without needing the secret key.

Developer Tools