Check an SSL/TLS certificate before browsers reject it
Look up the live certificate for any hostname — issuer, subject, validity window, the full chain of trust and the negotiated TLS version and cipher, so nothing expires by surprise.
Runs in the Website Inspector — no account, nothing to install.
Sample report · illustrative data
Everything the report surfaces
Expiry countdown
Shows the not-before and not-after dates with the days remaining, so a certificate is renewed long before it lapses.
Full chain of trust
Walks the certificate chain from leaf to root, flagging incomplete chains that pass in one browser but fail in another.
Issuer & subject
Reports the Certificate Authority, the covered hostnames and any Subject Alternative Names so coverage gaps are obvious.
TLS version & cipher
Confirms the protocol version negotiated (TLS 1.2 / 1.3) and the cipher suite, highlighting deprecated or weak choices.
Three steps to a full answer
Enter a hostname
Provide any https URL or domain. The checker connects on the standard TLS port.
We read the live certificate
The Website Inspector performs a real TLS handshake and captures the presented certificate and negotiated parameters.
Review validity and chain
See the expiry countdown, the issuing authority and the complete chain, with any trust or coverage problems called out.
Check an SSL/TLS certificate before browsers reject it
Open the Website Inspector and get your answer in seconds.
Go deeper in the reference library
Common questions
How do I check when an SSL certificate expires?
Enter the site's URL and the checker reads the live certificate, showing the not-after date and a countdown of the days remaining before it expires.
What does an incomplete certificate chain mean?
A server should send the leaf certificate plus any intermediates needed to reach a trusted root. If intermediates are missing, some clients cannot build the chain and show a security warning even though the certificate itself is valid.
Can it detect a weak TLS version or cipher?
Yes. The checker reports the negotiated TLS version and cipher suite and flags deprecated protocols such as TLS 1.0/1.1 and weak cipher choices.
Does the certificate cover this hostname?
The checker lists the certificate's subject and every Subject Alternative Name, so you can confirm the exact hostname you are serving is included.