SSL Certificate Checker

Inspect any website's SSL/TLS certificate: validity, days until expiry, issuer, covered hostnames, key strength and the TLS version negotiated.

Try: wikipedia.org, expired.badssl.com, wrong.host.badssl.com
The certificate for wikipedia.org is validTrusted, matches the hostname, and expires in 80 days.
Common name
*.wikipedia.org
Organization
— (domain validated)
Issuer
YE2 · Let's Encrypt
Valid from
4 Oct 2026, 18:34 UTC
Valid until
2 Jan 2027, 18:34 UTC 80 days left
Certificate lifetime
89 days
Hostnames (SAN)
*.m.mediawiki.org, *.m.wikibooks.org, *.m.wikidata.org, *.m.wikimedia.org, *.m.wikinews.org, *.m.wikipedia.org, *.m.wikiquote.org, *.m.wikisource.org, *.m.wikiversity.org, *.m.wikivoyage.org, *.m.wiktionary.org, *.mediawiki.org, *.planet.wikimedia.org, *.wikibooks.org, *.wikidata.org, *.wikifunctions.org, *.wikimedia.org, *.wikimediafoundation.org, *.wikinews.org, *.wikipedia.org, *.wikiquote.org, *.wikisource.org, *.wikiversity.org, *.wikivoyage.org, *.wiktionary.org, *.wmfusercontent.org, mediawiki.org, w.wiki, wikibooks.org, wikidata.org, wikifunctions.org, wikimedia.org, wikimediafoundation.org, wikinews.org, wikipedia.org, wikiquote.org, wikisource.org, wikiversity.org, wikivoyage.org, wiktionary.org, wmfusercontent.org
Public key
ECDSA secp256r1
Signature
SHA384
Serial number
6DB158652F329309A86E7D0E9DDFED9A4B2
Protocol
TLSv1.3 · TLS_AES_128_GCM_SHA256
HTTP/2 (ALPN)
Supported
Server
208.80.154.224:443

Check security headers for wikipedia.org · WHOIS

What does the SSL checker test?

We connect to the server on port 443 (or the port you specify), perform a real TLS handshake using the hostname you entered, and verify the certificate against the Mozilla trust store used by most software. You get a clear verdict plus the details you need to fix problems:

  • Trust: whether the certificate chains to a trusted certificate authority and the server sends the required intermediate certificates.
  • Hostname match: whether the name you visited is listed in the certificate's Subject Alternative Names.
  • Expiry: the exact dates and the number of days remaining. We flag anything under 21 days.
  • Strength: key type and size, signature algorithm, and the TLS version and cipher negotiated.

Common SSL errors and how to fix them

ErrorCauseFix
Certificate has expiredRenewal failed or was forgottenRenew and reload the web server; enable automatic renewal (ACME/Let's Encrypt).
Hostname mismatchThe certificate does not list this name (often www vs bare domain)Reissue the certificate with all hostnames as SANs, or use a wildcard.
Unable to get local issuer certificateMissing intermediate certificateInstall the full chain (fullchain.pem) rather than only the leaf certificate.
Self-signed certificateNot issued by a public CAUse a free certificate from a public CA such as Let's Encrypt.
Shorter certificate lifetimes are coming. Under a CA/Browser Forum decision, the maximum lifetime of public TLS certificates is being reduced in stages, starting with 200 days from March 2026. Automate renewals now. Learn more about SSL/TLS certificates.

Frequently asked questions

Is SSL the same as TLS?

TLS is the modern successor to SSL; all SSL versions are obsolete and insecure. People still say "SSL certificate" out of habit.

Can I check a certificate on a non-standard port?

Yes: add the port, for example example.com:8443.

Can I check an internal server?

No. For security, the checker only connects to public IP addresses.

Copied to clipboard