--- title: "Free SSL Checker — Certificate, Chain and Expiry Test" description: "Free SSL checker tool. Verify your SSL certificate validity, expiry date, and configuration. Instant results, no signup required." canonical: "https://lemwatch.com/tools/ssl-checker" source: "https://lemwatch.com" --- # SSL checker > Check if your SSL/TLS certificate is valid, properly configured, and when it expires. Get instant results for any URL. An SSL checker answers one question quickly: will a browser, a phone and an API client all trust this certificate right now? Enter a domain above and the check opens a live TLS connection to the host, reads the certificate it is actually served, and reports the issuer, the validity window, the days remaining, the protocol versions offered and whether the chain is complete. ## Why the chain matters more than the expiry date Most people check certificates the way they check milk — is it out of date? Expiry is the easy failure, and it is the one monitoring catches. The quieter failure is an incomplete chain. Desktop browsers cache intermediate certificates from other sites they have visited, so a site with a missing intermediate looks perfectly fine on your laptop and fails on a fresh Android phone, on curl, on a payment gateway callback and inside anything that ships its own trust store. The site owner sees a padlock. Their customers see a warning. This check walks the chain from leaf to root so you see the gap your own browser is hiding. ## What a good result looks like A healthy host serves a leaf certificate that covers the exact hostname you typed, presents every intermediate needed to reach a trusted root, offers TLS 1.2 and TLS 1.3, and has comfortably more than a month left. A certificate that is valid but expires in nine days is not a pass — it is a deadline. Automated renewal fails more often than teams expect, usually because a validation path changed, a cron stopped running, or the certificate was reissued somewhere the renewal script no longer touches. ## Common causes of a failed SSL check A certificate issued for the apex domain but served on the www host, or the reverse. A load balancer updated while one node kept the old certificate. A renewal that completed at the certificate authority but was never deployed to the server. A wildcard that covers one level of subdomain and not two. Each of these produces the same red padlock for a visitor and each is invisible until someone looks. ## From one check to continuous checking Running this by hand tells you the state of one host at one moment. Certificates fail at the moment nobody is looking — a ninety-day certificate that renewed fine eleven times will eventually miss the twelfth. Continuous SSL monitoring runs the same handshake on a schedule and warns you well before the date, which is the difference between a calendar reminder and an outage. ## What this tool checks - SSL certificate validity and issuer - Certificate expiry date and days remaining - TLS protocol version (1.2, 1.3) - Certificate chain completeness - SSL grade (A+ to F) ## Why it matters An invalid or expired SSL certificate breaks HTTPS, causing browser warnings that scare visitors away. Google also uses HTTPS as a ranking signal — sites without valid SSL rank lower. ## How to fix what it finds - Renew your certificate before it expires (set up auto-renewal) - Ensure your certificate chain is complete (include intermediate certificates) - Upgrade to TLS 1.3 for better security and performance - Use a reputable certificate authority (Let's Encrypt is free) ## Methodology We open a real TLS connection to the hostname you enter on port 443 and read the certificate the server presents, rather than looking anything up in a cached database. From that handshake we extract the subject and subject alternative names, the issuer, the notBefore and notAfter dates, the signature algorithm, and the negotiated protocol version. We then request the chain the server sends and check that every link between the leaf certificate and a publicly trusted root is present, because servers are free to send an incomplete chain and most browsers paper over it. Days remaining is computed from the notAfter date in UTC. The grade combines four inputs: whether the certificate is currently valid for the hostname, whether the chain resolves, which protocol versions are offered, and how much validity remains. We do not test cipher suite ordering or run a full protocol audit — that needs a longer scan than a single page load should take. Connections time out after ten seconds, and a timeout is reported as a timeout rather than as a failure, because a firewall blocking us is not the same as a broken certificate. ## This tool also answers ### How do I check an SSL certificate chain? Paste the domain above. The checker walks the full chain from your leaf certificate up to the trusted root, and flags any missing intermediate — the single most common cause of a certificate that works in a desktop browser but fails on Android, curl and API clients. ### Is there an SSL certificate checker tool online? Yes — this page is one. It runs entirely server-side against the live host, needs no signup, and returns issuer, validity window, chain integrity, protocol versions and days remaining in a few seconds. ### How do I check an SSL certificate expiry date? Enter the domain and read the "expires" field in the result. It shows the exact notAfter date from the live certificate plus days remaining, which is the number worth alerting on — most outages happen because nobody was watching that countdown. ## Frequently asked questions ### Why does my certificate work in Chrome but fail here? Almost always a missing intermediate certificate. Chrome may have cached that intermediate from another site, so it completes the chain for you silently. A fresh client — a phone, curl, a server-to-server call — has no such cache and fails. Install the full chain your certificate authority provides, not just the leaf. ### How many days before expiry should I renew? Treat anything under 30 days as urgent and anything under 14 days as an incident waiting to happen. Automated renewal typically attempts well ahead of the date, so if you are inside 30 days the automation has probably already failed once without telling anyone. ### Does this check the www and non-www versions separately? It checks the exact hostname you enter. They are genuinely different: a certificate can cover example.com and not www.example.com. Run both if you serve both, because visitors and links will reach both. ### What is a certificate chain? Your certificate is signed by an intermediate certificate, which is signed by a root certificate that the client already trusts. The chain is that path. If the server does not send the intermediate, the client cannot connect your certificate to anything it trusts, and the connection is rejected. ### Is a self-signed certificate ever acceptable? On an internal service where you control every client, yes. On anything a browser reaches, no — every visitor gets a full-page interstitial warning, and search engines treat the site as insecure. ### Why does the expiry date differ from what my registrar shows? Your registrar shows the domain registration expiry. This tool shows the TLS certificate expiry. They are unrelated dates from unrelated systems, and both can take a site down. ### How do I check an SSL certificate chain? Paste the domain above. The checker walks the full chain from your leaf certificate up to the trusted root, and flags any missing intermediate — the single most common cause of a certificate that works in a desktop browser but fails on Android, curl and API clients. ### Is there an SSL certificate checker tool online? Yes — this page is one. It runs entirely server-side against the live host, needs no signup, and returns issuer, validity window, chain integrity, protocol versions and days remaining in a few seconds. ### How do I check an SSL certificate expiry date? Enter the domain and read the "expires" field in the result. It shows the exact notAfter date from the live certificate plus days remaining, which is the number worth alerting on — most outages happen because nobody was watching that countdown. ## Lemwatch at a glance - What it is: website monitoring that checks uptime, page changes, SEO, security, SSL and speed in one tool. - Free plan: 10 sites, no time limit, all check types. - Pro: $19/mo, 50 sites, public API and webhooks. - Agency: $59/mo, 150 sites, white-label status pages. - Source: https://lemwatch.com/pricing (facts verified from the product's own plan limits). ## Related - [All free tools](https://lemwatch.com/tools) - [security header checker](https://lemwatch.com/tools/security-header-checker) - [DNS lookup](https://lemwatch.com/tools/dns-lookup) - [mixed content checker](https://lemwatch.com/tools/mixed-content-checker) - [Lemwatch pricing](https://lemwatch.com/pricing) - [All monitoring checks](https://lemwatch.com/features) - [Third Party Scripts Checker](https://lemwatch.com/tools/third-party-scripts-checker) - [SPF Record Generator](https://lemwatch.com/tools/spf-generator)