🔐 SSL Certificate Checker

Check a live domain's certificate, or upload a .pem / .crt / .cer file for deep technical analysis.

📂
Drop a certificate file here, or click to browse
Accepts .pem · .crt · .cer · .der · .txt (PEM or DER encoded)
SSL certificate essentials
🔒
Expiry is the silent killer
An expired certificate breaks HTTPS for all visitors instantly. Set calendar reminders or use auto-renewal (Let's Encrypt, Cloudflare) so you never miss the deadline.
🌐
Wildcard vs single-domain
A wildcard certificate (*.example.com) covers all subdomains. If you run multiple subdomains, a wildcard is cheaper and simpler than buying individual certs for each.
📋
Check the issuer chain
A certificate's trust depends on the issuing CA. Unknown or self-signed CAs cause browser warnings. Let's Encrypt, DigiCert, and Sectigo are widely trusted CAs.
🏆
TLS version matters
TLS 1.0 and 1.1 are deprecated. Ensure your server uses TLS 1.2 or TLS 1.3. An SSL check failing on TLS version is a common security audit finding that's easy to fix.
Frequently asked questions
What is an SSL certificate and why does my site need one?+

An SSL/TLS certificate enables HTTPS — the encrypted connection between a browser and a server. Without it, all data exchanged (including passwords and form submissions) travels as plaintext. Browsers mark HTTP sites as "Not Secure," and Google gives HTTPS sites a ranking advantage. Today, free certificates from Let's Encrypt make there's no excuse not to have one.

What is the difference between DV, OV, and EV certificates?+

Domain Validation (DV) only verifies that you control the domain — fast, free, and sufficient for most sites. Organization Validation (OV) additionally verifies the legal business entity. Extended Validation (EV) is the highest level, requiring extensive identity checks; it used to show the company name in the browser bar but modern browsers have largely removed that distinction.

Why does my SSL check show a grade lower than A?+

Common reasons: supporting deprecated TLS versions (1.0/1.1), using weak cipher suites, missing HSTS headers, a certificate chain that doesn't include intermediate certificates, or a certificate close to expiry. Enabling TLS 1.3 only and adding an HSTS header is often enough to move from B to A.

How do I get a free SSL certificate?+

Let's Encrypt provides free, automated DV certificates renewed every 90 days. Most hosting platforms and CDNs (Cloudflare, Netlify, Vercel) provision Let's Encrypt certificates automatically when you point your domain. For self-managed servers, the Certbot tool handles issuance and renewal automatically.

Does this tool check the certificate on my origin server or on Cloudflare?+

This tool checks the certificate presented to the public — what browsers and users actually see. If your site is behind Cloudflare or another CDN, the certificate you see here is the CDN's certificate, not the origin certificate. The origin-to-CDN connection may use a separate certificate that is not visible from a public SSL check.