SSL Certificate Checker

What is an SSL/TLS Certificate?

An SSL/TLS certificate is a digital document issued by a trusted Certificate Authority (CA) that binds a cryptographic public key to a domain name. It enables HTTPS — the encrypted, authenticated connection between a browser and a web server. Despite the common term "SSL," all modern certificates use TLS (Transport Layer Security). SSL 2.0, 3.0 and TLS 1.0/1.1 are all deprecated.

When you visit an HTTPS site, your browser verifies that the certificate is valid, not expired, issued by a trusted CA, and matches the hostname. If any check fails, the browser shows a security warning that blocks most users.

SSL Certificate Types

Certificates are categorised by the level of identity verification the CA performed before issuing them.

Common SSL Certificate Errors and Fixes

These are the most frequent errors browsers and monitoring tools report, and how to resolve each one.

TLS Protocol Version Comparison

SSL Certificate Lifecycle and 90-Day Certificates

Certificate lifetimes have been progressively shortened. Let's Encrypt issues 90-day certificates since its launch. In 2025, major CAs and browser vendors agreed to reduce the maximum certificate lifetime to 90 days, pushing the industry toward automated renewal (ACME protocol, certbot, Caddy auto-TLS).

Shorter lifetimes reduce the window of exposure if a private key is compromised but increase the risk of expiry-caused outages if renewal is not automated. Set up monitoring and automated renewal before relying on short-lived certs.

How to Check SSL Certificates from the Command Line

These commands let you inspect certificate details directly without a browser:

# View certificate subject, issuer, and validity dates
openssl s_client -connect example.com:443 -servername example.com \
  < /dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer

# Show the full certificate chain
openssl s_client -connect example.com:443 -servername example.com \
  -showcerts < /dev/null 2>/dev/null

# Check which TLS versions the server supports
nmap --script ssl-enum-ciphers -p 443 example.com

# Verify expiry date only
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate

# Test with a specific TLS version
openssl s_client -connect example.com:443 -tls1_3 -servername example.com

SSL and SEO

Google confirmed HTTPS as a ranking signal in 2014. Beyond rankings, an invalid or expired SSL certificate causes browsers to show blocking security warnings that prevent most users from reaching your site at all — a far larger traffic impact than any ranking factor. Expired certificates also fail Core Web Vitals fetches, removing pages from the CrUX dataset.

For sites migrating from HTTP to HTTPS: ensure 301 redirects are in place, update canonical tags, update your sitemap URLs, and submit the HTTPS property separately in Google Search Console.