Otaku Dojo Tools
English

SSL Certificate Checker

The SSL Certificate Checker completes a TLS handshake on port 443, reads the certificate the server presents and tells you how many days remain before it expires, whether it is issued by a trusted certificate authority, whether the hostname matches, which TLS version is used, and every domain listed in Subject Alternative Names. Untrusted or expired certificates are still read, with the reason shown.

  • Free
  • No sign-up
  • Checked by our server
Try:
Enter a URL and press Check
Enter a domain and press Check to see the certificate

How to use the SSL Certificate Checker

  1. Enter a domain (e.g. example.com) or full URL and press "Check".
  2. The top shows days remaining, trust, hostname match and TLS version.
  3. "Certificate" lists the issuer, validity period and covered domains.
  4. Fewer than 30 days remaining shows yellow; fewer than 14 days or expired shows red.

Examples

Check a Let's Encrypt certificate

Result from October 3, 2026. Let's Encrypt certificates last 90 days, so the count changes over time.

Input
otaku-dojo.com
Output
Days remaining: 31
Issuer: Let's Encrypt · YR1
Trusted: yes | Hostname: match | TLSv1.3
Domains: otaku-dojo.com, www.otaku-dojo.com

What to do when a certificate is about to expire

Let's Encrypt certificates last 90 days and are usually renewed automatically by tools such as certbot about 30 days before expiry. If fewer than 30 days remain and nothing has changed, automatic renewal has probably failed — check your server's scheduler and firewall. Commercial certificates must be renewed with your vendor and reinstalled.

"Hostname mismatch" means the certificate does not cover the domain you entered — for example it covers example.com but you connected to www.example.com. Reissue a certificate covering every domain or use a wildcard certificate (*.example.com).

Specs & key facts

ChecksDays remaining, validity period, issuer, subject, SAN list, TLS version
VerificationCertificate chain and hostname against trusted CAs
Untrusted certificatesStill read, with the failure reason (self-signed, expired, incomplete chain)
Ports443 by default; enter example.com:8443 for 8443
LimitsPublic URLs only, 20 checks per minute
PriceFree, no sign-up

FAQ

My browser says the site is secure but the tool says untrusted. Why?

Usually the server is not sending the full intermediate certificate chain. Browsers may fill the gap from cache, but other clients and some phones fail. Configure your server with the full chain certificate.

What is the difference between SSL and TLS?

TLS is the successor to SSL; SSL 3.0 and TLS 1.0/1.1 are deprecated. "SSL certificate" is still the common name, but sites should use TLS 1.2 or 1.3.

Can I check ports other than 443?

Ports 443 and 8443 are supported — enter example.com:8443. Other ports are blocked for security.