Free agency tools / SSL Certificate Checker
Is this SSL certificate healthy?
Check any domain's SSL/TLS certificate — who issued it, when it expires and which hostnames it covers — so an expired or mismatched certificate never takes a client's site offline on your watch.
Results for
How it works
- 1Enter a domain — we look up its most recent publicly-logged certificate.
- 2You get the issuer, the valid-from and valid-until dates and a live expiry countdown.
- 3The certificate's covered hostnames (SANs) are listed so you can confirm it matches the site.
Frequently asked
Where does this data come from?
From public Certificate Transparency logs, which every trusted certificate is recorded in. It reflects the latest certificate issued for the domain — the one a correctly-configured server should be serving.
How much expiry warning do I need?
Renew at least 2–4 weeks before expiry. Most automated systems (like Let's Encrypt) renew at 30 days left; if you're inside that window and it hasn't renewed, investigate now.
What does 'covers these names' mean?
A certificate is only valid for the exact hostnames (or wildcards) listed on it. If a site is served on a name the certificate doesn't cover, browsers show a security warning.
It says expired but my site works — why?
This shows the latest logged certificate; your server may already be serving a newer one that hasn't propagated to the logs, or be serving a different cert than the one logged. Re-check in a few minutes, or verify directly in the browser padlock.