UptimeTea
Free tool, no signup

SSL certificate checker
When does your certificate expire?

Enter a domain and see the certificate it serves: expiry date and days left, issuer, alternative names, whether the chain is trusted, and whether the hostname matches.

Check a certificate

Connects to port 443 only. Nothing is stored, and results are cached for five minutes.

What this checker looks at

Expiry date and days remaining

The not-after timestamp on the leaf certificate, counted down to today. Under 30 days is flagged as expiring so you renew before browsers complain.

Chain of trust

The handshake is verified against the system root store, the same way a browser does it. A missing intermediate or a self-signed certificate shows up as not trusted, with the reason.

Hostname match

The name you typed is compared with the subject and every subject alternative name, including wildcards, so you know the certificate really covers this domain.

Issuer, key and protocol

Who signed it, the key type and size, the signature algorithm and the TLS version the server negotiated. Useful when a security scan asks for details.

Common results and what to do about them

  1. 1

    Expired

    Renew and deploy the new certificate. If renewal is automated, find out why it did not run: an expired token, a changed DNS record, or a firewall blocking the validation request are the usual causes.

  2. 2

    Not trusted: incomplete chain

    Install the intermediate certificate alongside the leaf. Your certificate authority supplies a full-chain bundle for exactly this reason.

  3. 3

    Not trusted: self-signed

    Fine for internal tools, a hard error for anything public. Replace it with a certificate from a public authority. Let's Encrypt is free.

  4. 4

    Hostname does not match

    Reissue the certificate with the missing name as a subject alternative name, or redirect the unmatched hostname to one the certificate covers.

Frequently asked questions

How do I check when an SSL certificate expires?
Enter the domain above. The checker opens a TLS connection to port 443, reads the certificate the server presents, and shows its expiry date and the days remaining. You can also click the padlock in your browser, but this tool works for any domain and shows the whole chain.
How long are SSL certificates valid?
Publicly trusted certificates are capped at 398 days, and most are shorter. Let's Encrypt issues 90-day certificates, and the industry is moving toward 47-day maximums by 2029. Shorter lifetimes mean more renewals, which is why expiry alerts matter.
What happens when an SSL certificate expires?
Browsers show a full-page security warning and most visitors leave. API clients fail with certificate errors. Search engines can drop rankings while the site is unreachable. Automated renewal fixes most cases, but only if it actually runs.
Why does the checker say the chain is not trusted?
Usually the server sends only its own certificate and not the intermediate that links it to a trusted root. Browsers often work around this from cache, so the site looks fine to you while failing for other people, especially on mobile and in scripts. Install the full chain your certificate authority provided.
What is a hostname mismatch?
The certificate was issued for different names than the one you typed. A certificate for www.example.com does not cover example.com unless it is listed as a subject alternative name. Check the alternative names shown in the result.
Can I get an alert before my certificate expires?
Yes. Add the domain as an SSL monitor in UptimeTea and you get an email, SMS or call when the certificate is 30 days from expiry, again at 7, and immediately if it stops validating. SSL and domain monitoring are on the free plan.

Explore more

DNS propagation checker

Moving hosts? See which resolvers already serve the new record before you swap the certificate.

Status pages

Show customers your certificates and services are healthy on a white-label status page.

Response time monitoring

A valid certificate is step one. Track how fast the site behind it answers every minute.

For agencies

Watch every client certificate from one dashboard and get the alert before the client does.

Checking once is good. Being told is better.

UptimeTea keeps checking your certificates and alerts you 30 days before expiry, again at 7, and the moment a chain stops validating. SSL and domain monitoring are on the free plan, 50 monitors, no credit card.