The most common cause of a sudden outage is an expired certificate. Anything under 15 days remaining deserves attention today, not next week.
Check a certificate
Enter a domain name. The connection is made from our server, so the result reflects what the public internet sees.
What to check on a certificate
A certificate is only valid for the names listed on it. A cert covering example.com but not www.example.com will throw browser warnings on half your traffic.
TLS 1.2 is the practical minimum and TLS 1.3 is preferred. SHA-1 signatures and RSA keys under 2048 bits are rejected by modern browsers.
Frequently asked questions
What does this tool check?
It opens a real TLS connection to the host on port 443 and reads the certificate the server presents: who issued it, who it was issued to, when it expires, every domain name it covers, the negotiated TLS protocol version and the signature algorithm.
Why does it say the hostname does not match?
The certificate does not list the exact name you entered in its Common Name or Subject Alternative Names. This is usually a www versus non-www mismatch, or a certificate issued for a different domain on shared hosting. Browsers will show a security warning in this state.
When should I renew my certificate?
Renew at least 15 days before expiry. Automated issuers such as Let’s Encrypt issue 90-day certificates and typically renew at 30 days remaining, which leaves room for a failed renewal to be noticed and fixed.
Can I check a server on a non-standard port?
Yes. Add the port to the host, for example example.com:8443. If no port is given, 443 is used.
Does this work for internal or local servers?
No. Requests to private, loopback and link-local addresses are blocked for security reasons, so internal hostnames and IPs on your own network cannot be checked from here.