Waiting
Enter a domain and run a lookup to see results.
SSL Certificate Checker
Check any website's SSL certificate for expiry date, issuer, SAN, and chain integrity. Free SSL/TLS checker.
Detected
Certificate
—
Chain
—
TLS
—
Issuance History
—
PEM
—
Tool Features
Related Guides
SSL/TLS Certificate & Security Check
Verify any domain's SSL certificate — expiry date, issuer, SAN coverage, chain trust and the negotiated TLS version. The tool grades the configuration from A+ to F: certificate validity (40%), TLS version (25%), chain trust (15%) and the HSTS header (20%, scored on max-age, includeSubDomains and the preload directive). Certificate Transparency logs show issuance history.
How It Works
Our observation server in Seoul performs a real TLS handshake: it reads the certificate, checks that the chain is trusted and records the negotiated TLS version. A separate request from Cloudflare's edge reads the HSTS header. Issuance history comes from Certificate Transparency logs (crt.sh), which are also the fallback when the Seoul server can't reach the site. Each part is scored separately and the weighted sum sets the grade. From Seoul it also asks the CA whether the certificate was revoked — OCSP first, then the CRL — and accepts only answers signed by the issuer; when neither answers, revocation is shown as not determined and does not affect the grade. The same Seoul server also tries a handshake with each of TLS 1.0, 1.1, 1.2 and 1.3 and with each TLS 1.2 cipher suite to see what the server accepts (no data sent, no vulnerability probes); accepting TLS 1.0/1.1 or offering no forward-secret suite caps the grade at B, as SSL Labs does. It then writes its own ClientHello messages byte by byte — the opening message any client sends — and reads only the server's first answer, to find what OpenSSL can no longer offer: SSL 3.0, RC4, 3DES, export, NULL and anonymous suites, Korean national ciphers (SEED, ARIA), TLS compression, secure renegotiation, TLS_FALLBACK_SCSV, the DH group size and the TLS 1.3 key exchange groups. Grade caps follow SSL Labs: F for broken suites or DH under 1024 bits, C for SSL 3.0, RC4, compression or no secure renegotiation, B for 3DES or 1024-bit DH. Tests that need crafted packets (Heartbleed, ROBOT) are not run.
FAQ
What does an SSL grade of A+ mean?
A+ means 95 or more of 100 points: a valid certificate with a trusted chain, TLS 1.3, and an HSTS header with a max-age of at least one year and includeSubDomains. TLS 1.2 can still reach A+, but only if everything else is perfect, including the HSTS preload directive.
How do I fix an expired SSL certificate?
Renew the certificate through your CA or hosting provider. If you use Let's Encrypt, check that your auto-renewal cron/certbot is running. After renewal, restart your web server to load the new certificate. Use this tool to verify the new expiry date.
Why does my site show "certificate chain incomplete"?
Your server is not sending the intermediate certificate(s) needed to chain back to a trusted root CA. Configure your server to include the full chain — most CAs provide a "fullchain" or "ca-bundle" file for this purpose.
Why is my grade different from SSL Labs?
The grade caps follow SSL Labs (F for broken suites, C for SSL 3.0 or RC4, B for TLS 1.0/1.1, 3DES or an incomplete chain), but the points are weighed differently. Here 100 points are split into certificate validity 40, TLS version 25, chain trust 15 and HSTS 20, so a site without HSTS loses 20 points and usually lands at B; SSL Labs (rating guide 2009r) scores protocol support 30%, key exchange 30% and cipher strength 40%, and sets a site without HSTS to A-. We also connect once from Seoul instead of simulating many client handshakes.