Security Tool

SSL Certificate Checker

Check SSL certificate details, expiration dates, and issuer information for any domain.

How it works

This tool queries Certificate Transparency logs (crt.sh) to show SSL certificate information for any domain. It displays certificate details including issuer, validity dates, and expiration status. Note: This shows historical certificate data from CT logs. For real-time certificate validation, use browser developer tools or command-line tools like openssl s_client.

Check Certificate

Domain Name

Enter a domain name (with or without protocol). Examples: example.com, https://github.com

About Certificate Transparency

What is Certificate Transparency?

Certificate Transparency (CT) is an open framework that logs all SSL/TLS certificates issued by Certificate Authorities. This tool queries CT logs to show certificate information for any domain.

Limitations:

Shows historical certificate data from CT logs, not real-time certificate status
May not show all certificates if they weren't logged to CT
For real-time validation, use browser developer tools or openssl s_client

Manual Certificate Check:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates -issuer -subject

Was this tool helpful?

About the SSL Certificate Checker

Expired certificates remain one of the most preventable causes of production outages — the failure is total, instant, and scheduled years in advance. This checker fetches a domain's certificate chain and reports expiry dates, issuer, SANs, key details, and certificate transparency log presence.

Beyond expiry, it answers the diagnostic questions behind TLS errors: does the SAN list actually include the hostname being requested, is the chain complete or missing an intermediate, and did the certificate rotate when you think it did.

Frequently asked questions

Why do browsers say my certificate is invalid when openssl shows it fine?

Usually an incomplete chain: your server must send the leaf plus all intermediates. openssl on a machine with cached intermediates may validate anyway, while browsers and strict clients fail. Test with openssl s_client -connect host:443 -showcerts and verify every intermediate is present.

How far ahead should certificate expiry alerts fire?

At 30 and 14 days for manually managed certs — enough time for procurement and change windows — and at 7 days as a critical for automated (ACME/Let's Encrypt) certs, because automation failing with a week left means renewals have been failing for weeks already. Monitor expiry of what is actually served, not what is in the secret store.

What are certificate transparency logs and why check them?

CT logs are public, append-only records of every certificate issued by trusted CAs — browsers require log inclusion. Checking CT for your domains reveals unexpected issuance: a cert you didn't request can indicate compromised DNS validation, a rogue insider, or shadow-IT infrastructure. Monitoring CT for your apex domains is cheap early warning.

Need this managed for you, not just automated?

We're also a hands-on DevOps consultancy — Kubernetes, CI/CD, and cloud infrastructure.

Explore Our Services