SSL Checker
Check the SSL certificate a site actually serves: when it expires, who issued it, which names it covers, and whether the chain is complete. The HTTPS setup around it is checked too: the redirect from HTTP, HSTS, and which TLS versions are switched on.
What the SSL checker tests
| Check | Why it matters |
|---|---|
| Expiry date | An expired certificate puts a full-page warning in front of the site, and most visitors leave. |
| Name match | The certificate must list the hostname, or a wildcard covering it. A certificate for example.com doesn't cover www.example.com unless it says so. |
| Certificate chain | The server should send the intermediate certificates that link its own to a trusted root. Without them, some phones, apps and crawlers refuse to connect. |
| HTTP to HTTPS | Visitors and links that use http:// should be redirected with a 301. |
| HSTS | Tells browsers to go straight to HTTPS next time. |
| TLS versions | TLS 1.2 and 1.3 should be on; 1.0 and 1.1 are deprecated and best switched off. |
How the certificate is read
We open a connection to the server on port 443 and read the certificates it presents, exactly as a browser receives them, then close the connection before any data is exchanged. Separate short connections ask which TLS versions the server accepts.
A few servers can't be reached that way, for example ones that only speak TLS 1.3, which encrypts the certificate. For those, the details come from the public Certificate Transparency logs that every trusted certificate authority must publish to, and the result says so.
Questions
Does HTTPS affect SEO?
Yes, a little. Google uses HTTPS as a lightweight ranking signal, and Chrome labels HTTP pages "Not secure". A broken certificate does much more damage: browsers block the page, so visitors and crawlers can't reach it.
How often do certificates need renewing?
Since March 2026, public certificates last at most 200 days, and the limit falls to 100 days in March 2027 and 47 days in March 2029. Let's Encrypt certificates last 90 days. Automatic renewal is the only practical approach.
What does a missing intermediate certificate mean?
Your certificate is signed by an intermediate, which is signed by a root that devices trust. If the server doesn't send the intermediate, desktop browsers can often fetch it themselves, but many phones, apps and command-line tools fail. Installing the "full chain" file fixes it.
My site is behind Cloudflare. Which certificate is shown?
The one visitors see: Cloudflare's edge certificate. The certificate on your origin server, between Cloudflare and your host, isn't visible from outside.