Free tool
See when any website's certificate expires, who issued it and whether browsers will trust it. A live check from our server in the UK, with nothing to install.
Enter a domain, such as example.com, to read its live certificate.
When you press Check SSL, our server opens a secure connection to the site on port 443, the same handshake your browser makes, and reads the certificate it is given.
You see the expiry date and the days left, the issuing certificate authority, who the certificate was issued to, every name it covers, the TLS version the server chose, the key type, the serial number and the SHA-256 fingerprint.
It also verifies the certificate the way a browser would: does the chain lead to a trusted root, has anything in it expired, and does the certificate list the name you checked? If any of those fail, the result says which one and why.
Green means the certificate is valid, trusted and has at least 30 days left. Amber means fewer than 30 days remain, so plan the renewal or confirm that automatic renewal has worked. Red means it expires within a week, has already expired, or browsers will not trust it.
The bar under the verdict shows how much of the certificate's lifetime has passed. A certificate issued for 90 days that is three quarters through needs attention sooner than its date might suggest, especially if it normally renews on its own. If the checker shows an expired certificate, our guide to an expired SSL certificate explains the common causes and fixes, and how to check an SSL certificate's expiry date covers the browser, openssl and Windows Server.
Since 15 March 2026, publicly trusted certificates can be issued for at most 200 days. The limit falls to 100 days from 15 March 2027 and 47 days from 15 March 2029, under CA/Browser Forum ballot SC-081. Read what that means in our guide to the SSL certificate expiry changes.
A one-off check tells you where a certificate stands today. Renewals fail quietly, though: a cron job stops, a DNS validation record is removed, or a server is rebuilt without its renewal script. PulseStack™'s SSL certificate monitoring repeats this check up to once an hour and alerts you before the date arrives, or straight away if the certificate stops being trusted.
SSL monitors are included from the Starter plan at £9 a month, alongside website, keyword and domain expiry monitors. Compare the plans on our pricing page, or check whether a whole site is up with the website down checker.
Type a hostname such as example.com or www.example.com. A full URL works too: the checker uses only the hostname.
Our server in the UK connects on port 443 and reads the certificate the site presents.
See the expiry date, days left, issuer, chain trust and whether the certificate covers the name.
Renew anything close to expiry, then set up a monitor so the next renewal cannot slip past.
Yes. It is free to use with no account. To keep it quick for everyone there is a fair-use limit of 20 checks a minute for each visitor.
Yes. It opens a normal secure connection to port 443 of the hostname you enter and reads the public certificate the server sends, exactly as a browser does. Nothing is sent to the site, nothing is installed and the results are not saved.
Enter the domain above and the checker shows the expiry date and the number of days left. In a browser you can click the padlock or site information icon next to the address and open the certificate details. On Linux or a Mac, run: openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -enddate
Browsers only accept a certificate when it chains up to a root certificate they trust, has not expired and lists the name in the address bar. The checker tells you which of those failed: for example a self-signed certificate, a missing intermediate certificate, or a certificate issued for a different name.
Under the CA/Browser Forum's ballot SC-081, publicly trusted certificates issued since 15 March 2026 can be valid for at most 200 days. The limit falls to 100 days from 15 March 2027 and 47 days from 15 March 2029. Shorter lifetimes mean more renewals, so an automatic renewal that silently fails is found sooner.
It reports the TLS version the server negotiated, whether the chain is trusted and whether the name matches. It does not grade cipher suites or test for protocol weaknesses. For that, the Security Shield, a separate PulseStack™ subscription, includes a TLS configuration test.
Yes. SSL certificate monitors are included from the Starter plan at £9 a month. PulseStack™ checks the certificate up to once an hour and alerts you when it is within your chosen number of days of expiry (7 by default) or stops being valid. Every paid plan starts with a 14-day free trial with no card needed.
Every one runs a real check, live, with nothing to install.
PulseStack™ checks your certificates up to once an hour and alerts you before they expire. SSL monitors come with every paid plan from £9 a month, and the Free plan covers 25 website monitors with no card required.