SSL Certificate Check
Inspect the TLS certificate served by a host: who issued it, who it is for, when it expires and whether it is valid, revoked or self-signed.
- Runs on our servers
- Free to use
- API available →
About this tool
An expired or misconfigured certificate takes a site offline for every visitor, so checking it from the outside is part of any deployment. This tool connects to the host and port with the APIVoid SSL Info API and reports the validity, expiry countdown, issuer, subject and SANs, key algorithm and size, signature algorithm, serial number, SHA-1 and SHA-256 fingerprints, key usages and CRL endpoints. It also flags self-signed, revoked and blacklisted (SSLBL) certificates.
Pair it with the TLS Version Checker to make sure only modern protocol versions are enabled, and with the Security Headers Analyzer for HSTS.
How to use it — quick steps
- 01
Enter the domain or hostname
Type or paste the domain or hostname in the field above, for example www.example.com.
- 02
Press "Check certificate"
Press "Check certificate" or Ctrl + Enter. The result appears below in a few seconds. Results can be copied.
- 03
Read the result
It appears in the dark panel under the form in a few seconds. Every block has [copy] and other actions.
Key features of this tool
External lookups
The lookup runs from our infrastructure, so you see what the public internet sees without exposing your own IP address or network.
Fast and cached
Results come back in seconds; identical lookups are cached for a few minutes to keep the service fast and responsive for everyone.
Easy to reuse
Every result block can be copied with one click or downloaded as a text file, and tables can also be saved as CSV for your reports.
Frequently asked questions
The certificate is valid but my browser shows an error
Browsers also check the hostname you typed against the subject alternative names, the full chain and revocation. A valid leaf served without its intermediate certificate is a frequent cause; the "name matches host" row shows the first problem.
How many days before expiry should I renew?
At least two weeks. Let's Encrypt certificates last 90 days and are usually renewed automatically at 30 days left; if the counter keeps dropping, automation is broken.
What is the validation type (DV, OV, EV)?
How thoroughly the CA verified the owner: domain control only (DV), organisation identity (OV) or extended vetting (EV). Let's Encrypt provides free DV certificates. All provide the same encryption.
Can I check a mail or other non-web port?
Yes, enter the port. Services that use STARTTLS (SMTP 25/587) are not supported; use implicit TLS ports such as 465, 993 or 995.