Free SSL Checker
Check a domain's certificate
Our server connects to the domain and its www twin on port 443, reads each certificate, and tests the http redirect and the HSTS header, the way a first-time visitor's browser meets your site.
Public domains only, on the standard ports (443 for HTTPS, 80 for the redirect test). Private and local addresses are refused. Nothing you check is stored.
Enter a domain to see whether its SSL certificate is valid, trusted by browsers and phones, and covers both example.com and www. The checker also tests the expiry date, the HTTP to HTTPS redirect, HSTS and TLS versions, grades the setup, and explains every result in plain English. Also called an SSL certificate checker, HTTPS checker, SSL expiry checker, TLS certificate test or SSL test.
- Free, no signup
- Checks the domain and www together
- Calendar reminder, no email
Seeing one of these errors?
NET::ERR_CERT_DATE_INVALID, NET::ERR_CERT_COMMON_NAME_INVALID, NET::ERR_CERT_AUTHORITY_INVALID, SSL_ERROR_BAD_CERT_DOMAIN, SEC_ERROR_UNKNOWN_ISSUER, MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT, ERR_SSL_VERSION_OR_CIPHER_MISMATCH, Your connection is not private. Run the check above and the result names the cause.
SSL included
Every Grigora site includes free SSL and a global CDN on every plan.
Describe your business and the AI builder makes a complete multi-page site. Connect your own domain on any paid plan. 14 day free trial, no card needed.
How to check an SSL certificate
Four steps from a domain name to a clean, graded result.
Enter your domain
Type example.com or paste any URL from the site. The path is ignored; the domain and its www twin are checked.
Run the check
Our server connects on port 443, reads each certificate, then tests the http redirect and the HSTS header for both names.
Read the verdict and grade
The verdict says in one sentence whether visitors see a warning. The line under the grade names the rule that set it.
Fix, re-check and set a reminder
Open How to fix under each warning, check again after the change, then add the expiry date to your calendar.
How to check an SSL certificate, step by step
Real screenshots of the tool, taken while checking a live domain.
- 1
Enter your domain
Type the bare domain or paste any address from the site. The path is ignored, and the www twin is checked with it.
- 2
Run the check
Our server connects on port 443, reads the certificate, then follows the plain http address to see where it goes.
- 3
Read the grade, then set a reminder
The verdict says whether visitors see a warning, each row explains one check, and the calendar buttons remind you before expiry.
What the SSL Checker tests
Every row in the result, what it catches and why it matters to a visitor.
| Check | What it catches | Why it matters |
|---|---|---|
| HTTPS works | No certificate, port 443 closed, a failed handshake | Without it browsers mark the site Not secure or refuse to open it. |
| Trusted by browsers and phones | Self-signed or private certificates, a missing intermediate | A missing intermediate works in your browser but fails on some phones and apps. |
| Name matches | A certificate for another name, www not covered | A mismatch shows a full-page warning before anything loads. |
| Expiry and renewal health | Expired or nearly expired certificates, auto-renewal that stopped | Renewal jobs fail quietly; the warning shows up on the day it expires. |
| HTTP to HTTPS redirect | Plain http pages, redirect loops, port 80 closed | Old links and typed http:// addresses land on an unencrypted page. |
| www and apex | One name broken, two copies of the site | Visitors type both; each needs a valid certificate and one final address. |
| HSTS | No header, a malformed header, a short max-age | Optional protection against downgrade, and the difference between A and A+. |
| TLS versions and cipher | TLS 1.0 or 1.1 still on, weak ciphers or small keys | Old protocols and ciphers weaken the connection for everyone. |
| Issuer, CAA and HTTP/2 | Who issued the certificate and who is allowed to | A CAA record that leaves out your issuer blocks the next renewal. |
How the grade works: no HTTPS, an expired, self-signed or untrusted certificate is an F, and a certificate for the wrong name gets no letter. Otherwise the grade starts at A. An incomplete chain, TLS 1.0 or 1.1, a weak cipher, expiry within 7 days, a stalled renewal, a missing redirect or a broken www or apex name caps it at B, and no TLS 1.3 caps it at A-. An A+ adds HSTS of at least six months and a working redirect. A missing HSTS header never fails a site.
When to run this check
Six moments a certificate problem is the likely culprit.
The browser says Not secure
Find out whether it is the certificate, the name on it, or a missing redirect from http.
Right after connecting a domain
Confirm the certificate covers both example.com and www before you share the address.
After moving host or CDN
Migrations are where certificates, redirects and TLS settings quietly change.
Works on desktop, fails on phones
That pattern usually means a missing intermediate certificate, which this check names.
No more expiry emails
Let's Encrypt stopped sending expiry emails in June 2025, so a failed renewal can go unnoticed.
Before a launch
Clear every warning before the first customer sees the site, then set the reminder.
Fixing SSL on your platform
Where the certificate, redirect and TLS settings live.
cPanel and shared hosting
- Open SSL/TLS Status in cPanel and run AutoSSL for the domain and its www name.
- If your host installs certificates by hand instead, include the CA bundle so the chain is complete.
- Turn on the host's force HTTPS option, or add a 301 redirect in .htaccess, then check again.
Cloudflare
- Under SSL/TLS, set the encryption mode to Full (strict) so the link to your server is checked too.
- Under SSL/TLS, Edge Certificates, turn on Always Use HTTPS.
- On the same page, set Minimum TLS Version to 1.2 if this check shows TLS 1.0 or 1.1 accepted.
Nginx or Apache with Certbot
- Request one certificate for both names: certbot --nginx (or --apache on Apache) -d example.com -d www.example.com.
- Point the server at fullchain.pem, not cert.pem, so the intermediate is sent.
- Run certbot renew --dry-run to confirm automatic renewal works.
Grigora
- Every plan includes hosting with free SSL and a CDN.
- On a paid plan, connect your own domain in the domain settings and add the DNS records shown there.
- SSL is applied automatically to a connected domain. If you connect only the root domain, follow the SSL note shown in the domain settings, then run this check on both example.com and www.
Common SSL errors and how to fix them
The messages browsers show, what causes each one, and what to change.
NET::ERR_CERT_DATE_INVALID
Cause: The certificate has expired, or the visitor's device clock is set wrong so a valid certificate looks out of date.
Fix: Renew or reissue it in your hosting or CDN dashboard, then find out why automatic renewal stopped.
NET::ERR_CERT_COMMON_NAME_INVALID
Cause: The certificate is for a different name. Firefox calls it SSL_ERROR_BAD_CERT_DOMAIN.
Fix: Reissue the certificate with both example.com and www.example.com on it, and check DNS points at the right server.
NET::ERR_CERT_AUTHORITY_INVALID
Cause: A self-signed certificate or one from a private authority. Firefox shows MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT or SEC_ERROR_UNKNOWN_ISSUER.
Fix: Install a certificate from a public authority. Let's Encrypt issues them free and most hosts do it for you.
Works in my browser, fails on phones
Cause: The server sends the certificate without its intermediate. Desktop browsers often fetch or cache it; many apps do not.
Fix: Install the full chain: the CA bundle in your panel, or fullchain.pem with Certbot.
Not secure in the address bar
Cause: The page loaded over plain http, usually because http:// does not redirect to https://.
Fix: Turn on your host or CDN setting that forces HTTPS, or add a permanent 301 redirect.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Cause: The server only offers old TLS versions or ciphers, or has no certificate for this name.
Fix: Enable TLS 1.2 and 1.3 and make sure a certificate is installed for this exact name.
ERR_TOO_MANY_REDIRECTS
Cause: A redirect loop, often a CDN in Flexible SSL mode talking http to a server that redirects to https.
Fix: Use Full (strict) mode on the CDN, or remove one of the two redirects.
Padlock missing on one page only
Cause: Mixed content: an image, script or iframe on that page still loads over http.
Fix: Scan the page with the Mixed Content Checker and switch each http URL to https. Open the Mixed Content Checker.
How certificate lifetimes are changing
Certificates are getting shorter, so renewing by hand stops being practical. The dates below come from the CA/Browser Forum's Baseline Requirements and from Let's Encrypt.
4 June 2025
Let's Encrypt stopped expiry emails
Let's Encrypt ended its expiration notification emails and suggests a third-party monitoring service instead.
Source: Let's Encrypt, 26 June 202515 March 2026
200 day maximum
Publicly trusted certificates issued from this date may be valid for at most 200 days, down from 398.
Source: CA/Browser Forum Baseline Requirements 6.3.2, ballot SC-081v310 February 2027
Let's Encrypt moves to 64 days
The default profile switches from 90 day to 64 day certificates.
Source: Let's Encrypt, 2 December 202515 March 2027
100 day maximum
Certificates issued from this date may be valid for at most 100 days.
Source: CA/Browser Forum Baseline Requirements 6.3.2, ballot SC-081v316 February 2028
Let's Encrypt moves to 45 days
The default profile drops again, to 45 day certificates. Let's Encrypt advises renewing about two thirds of the way through a certificate's life.
Source: Let's Encrypt, 2 December 202515 March 2029
47 day maximum
Certificates issued from this date may be valid for at most 47 days.
Source: CA/Browser Forum Baseline Requirements 6.3.2, ballot SC-081v3
Browsers are tightening up on plain HTTP too. Google announced that from Chrome 154 (October 2026) the Always Use Secure Connections setting is on by default for all users, so Chrome asks for permission before the first visit to a public site without HTTPS (Google, 28 October 2025). What this means for you: use automatic renewal, which most hosts and CDNs provide, redirect http to https, and check both regularly.
Frequently asked questions
Short answers about SSL certificates and this checker.
Related free tools
Other checks that pair with the SSL Checker.
Mixed Content Checker
Find http images, scripts and iframes that break the padlock on an https page.
Try itRedirect Checker
Follow a redirect chain hop by hop and see every status code.
Try itWebsite Grader
Grade one page on estimated speed, findability, security, mobile and customer essentials.
Try itFavicon Checker
Check the icons browsers and phones show for your site.
Try itMeta Viewport Checker
Confirm a page is set up to render properly on phones.
Try itWebsite Launch Checklist
Work through what to verify before a site goes live.
Try itSSL that comes with the site
Site, email and store on one platform. Hosting with free SSL and a CDN comes with every plan. 14 day free trial, no card needed.
Start your free trial