SSL Certificate Checker Developer Tool
Check the TLS certificate a hostname presents — issuer, expiry, and Subject Alternative Names.
An expired TLS certificate turns into a browser warning page for every visitor with no notice beforehand unless you're watching for it. This free SSL checker is a developer tool that connects to a hostname, reads the certificate it presents, and reports its issuer, validity window, days remaining, and Subject Alternative Names — a quick way to confirm a certificate is live and healthy before it becomes an outage.
Hostname
No https:// scheme or trailing path — just the hostname. Port 443 is assumed.
Only the hostname you submit is sent to the server, solely to connect to it and read its certificate — nothing is logged or stored.
What this actually checks
This tool connects to the hostname you provide on port 443, performs a TLS handshake, and reads the certificate the server presents during that handshake — its subject, issuer, validity dates, and Subject Alternative Names. That's useful and honest information, but it's not the same as full browser-grade validation: a browser also walks the entire certificate chain up to a trusted root, checks revocation status (via OCSP or CRL), and enforces hostname matching rules strictly. This tool reports what the server presents and whether it's within its validity window; it doesn't replace opening the site in a browser and checking for a padlock with no warnings.
Why expiry monitoring matters
A certificate that expires without being renewed doesn't degrade gracefully — every browser throws a hard interstitial warning, most API clients and mobile apps simply fail the connection outright, and the outage is invisible until someone actually visits the site or a monitoring alert fires. Because renewal is often automated and silent when it works, the failure mode people actually hit is when automation quietly breaks (a cron job stops running, a DNS change breaks a validation challenge) and nobody notices until the certificate is already gone. Checking days-remaining periodically, or wiring an alert to fire well before zero, is cheap insurance against a self-inflicted outage.
Why a low days-remaining count often isn't a problem
Let's Encrypt, the certificate authority behind the majority of the web's TLS certificates, issues certificates with a 90-day validity period and renews them automatically at around the 60-day mark by design — so seeing 20 or 30 days remaining on a Let's Encrypt certificate is frequently just normal mid-cycle behaviour, not a sign anything is wrong. A count that's genuinely worth investigating is one that keeps shrinking past the point renewal should have kicked in, or a certificate authority known to issue longer-lived certificates (a year or more) sitting under two weeks remaining.
Where the certificate comes from
If you're running on Lightsail behind a load balancer, TLS termination and certificate renewal are typically handled for you by AWS's managed certificates attached to the load balancer, rather than a certificate file living on the instance itself. Either way, a domain has to actually resolve to your server before a public certificate authority can issue or renew anything for it — see the DNS tool for checking that a hostname points where you expect before troubleshooting a certificate problem that might really be a DNS problem.