What does the SSL checker test?
We connect to the server on port 443 (or the port you specify), perform a real TLS handshake using the hostname you entered, and verify the certificate against the Mozilla trust store used by most software. You get a clear verdict plus the details you need to fix problems:
- Trust: whether the certificate chains to a trusted certificate authority and the server sends the required intermediate certificates.
- Hostname match: whether the name you visited is listed in the certificate's Subject Alternative Names.
- Expiry: the exact dates and the number of days remaining. We flag anything under 21 days.
- Strength: key type and size, signature algorithm, and the TLS version and cipher negotiated.
Common SSL errors and how to fix them
| Error | Cause | Fix |
|---|---|---|
| Certificate has expired | Renewal failed or was forgotten | Renew and reload the web server; enable automatic renewal (ACME/Let's Encrypt). |
| Hostname mismatch | The certificate does not list this name (often www vs bare domain) | Reissue the certificate with all hostnames as SANs, or use a wildcard. |
| Unable to get local issuer certificate | Missing intermediate certificate | Install the full chain (fullchain.pem) rather than only the leaf certificate. |
| Self-signed certificate | Not issued by a public CA | Use a free certificate from a public CA such as Let's Encrypt. |
Shorter certificate lifetimes are coming. Under a CA/Browser Forum decision, the maximum lifetime of public TLS certificates is being reduced in stages, starting with 200 days from March 2026. Automate renewals now. Learn more about SSL/TLS certificates.
Frequently asked questions
Is SSL the same as TLS?
TLS is the modern successor to SSL; all SSL versions are obsolete and insecure. People still say "SSL certificate" out of habit.
Can I check a certificate on a non-standard port?
Yes: add the port, for example example.com:8443.
Can I check an internal server?
No. For security, the checker only connects to public IP addresses.