SSL Checker
Check whether your SSL certificate is installed correctly, including the missing intermediate certificate your browser hides, and how many days are left before it expires. Enter a hostname such as example.com, or example.com:8443 for another port.
- Free
- No signup required
- Live TLS connection
Common SSL certificate problems
Missing intermediate certificate
Your server sends its own certificate but not the intermediate that links it to a trusted root. Chrome and Safari often still show a padlock because they fetch or remember the missing piece, but curl, Java, Python, Node, Android apps and payment webhooks refuse the connection. Install the full chain: fullchain.pem for Let's Encrypt, or your certificate followed by the CA bundle for a commercial certificate.
Certificate expired
Automatic renewal stopped working: a cron job or certbot timer that no longer runs, a DNS or HTTP validation that now fails, or a certificate renewed on disk but never loaded because the server was not reloaded. Renew it, reload nginx or Apache, and check again here to confirm the new expiry date is live.
Hostname mismatch
The certificate does not list the name you connected to. A certificate for example.com does not cover www.example.com unless www is in its Subject Alternative Names, and a wildcard such as *.example.com covers one level only (shop.example.com, not a.shop.example.com). Check the SAN list in the result and reissue the certificate with every name you serve.
Self-signed or untrusted certificate
The chain ends in a certificate that is not in the standard trust stores: a self-signed certificate, an internal company CA, or a default certificate left by a control panel or load balancer. Browsers warn and API clients refuse. Replace it with a certificate from a public CA such as Let's Encrypt.
Wrong certificate served
The server answers with a certificate for another site. This usually means the virtual host for this name is missing or the server is not using SNI to pick the right certificate, so it falls back to its default. On shared hosting, cPanel or a CDN, check that the custom domain is attached and its certificate has finished issuing.
Old TLS version only
The server offers nothing newer than TLS 1.0 or 1.1, which current browsers and many clients no longer accept. Enable TLS 1.2 and 1.3 in your server or load balancer settings. The TLS Version Checker shows exactly which versions are on.
How to check an SSL certificate
- Enter the hostname, for example example.com or www.example.com. Add :port for a service on another port, such as example.com:8443.
- Click Check SSL.
- Read the health verdict, then the chain: anything between your certificate and the root marked as from the trust store was not sent by your server.
- Check the SAN list covers every name you use and note the days left.
- After fixing the server, reload it and check again.
What is an SSL certificate chain?
An SSL (strictly, TLS) certificate proves that a server is allowed to use a hostname. A certificate authority signs it, usually through an intermediate certificate, and the intermediate is signed by a root certificate that operating systems and browsers already trust. A client accepts your certificate only if it can build that path from your certificate to a trusted root.
The root is already on the client. The intermediate is not, so your server has to send it with your certificate. When it does not, browsers often repair the chain themselves, by downloading the intermediate or using one cached from another site. Most other software does not. That is why a broken chain can go unnoticed for weeks until a customer's integration, a mobile app or a payment webhook starts failing.
This checker connects the way those strict clients do, using only what your server sends plus the standard trusted roots. A missing intermediate shows up here even when your browser shows a padlock.
Health is based on the certificate's expiry: Healthy above 30 days, Warning at 30 days or fewer, Critical at 7 days or fewer. Expired or Invalid means visitors and API clients are already seeing errors.
# nginx: point ssl_certificate at the full chain, not the certificate alone ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
When to use an SSL checker
A webhook or API client fails with a certificate error
Stripe, PayPal or a partner's integration reports an SSL error but the site looks fine in Chrome. Check here: a missing intermediate is the most common cause.
After installing or renewing a certificate
You uploaded a new certificate in cPanel, Plesk or an AWS load balancer. Confirm the server is actually serving it, with the full chain and the new expiry date.
Custom domains on Vercel, Netlify or Shopify
The platform issues the certificate once your DNS is correct. Check whether it has been issued yet and covers both the apex and www.
Services on other ports
Mail servers, admin panels and APIs on ports such as 8443 or 993 have certificates that are easy to forget. Enter host:port to check them too.
Check something else
- TLS Version CheckerSee which TLS versions a server accepts, from TLS 1.0 to TLS 1.3, and the cipher it picks for each.
- Bulk SSL CheckerCheck SSL certificates for up to 50 hostnames at once: expiry, days left, chain and issuer, with CSV export.
- Domain Expiry CheckerSee exactly when a domain expires and how many days are left before renewal.
- Website Down CheckerCheck if a website is down for everyone or just you, with status code, response time and final URL.
Frequently asked questions
My site works in Chrome. Why does this checker say the intermediate is missing?
Browsers repair incomplete chains on their own. Most other software does not, so the error is real for API clients, apps and other servers even when your browser shows a padlock.
Does this checker download missing intermediates?
No, on purpose. It only uses the certificates your server sends plus the standard trusted roots, which is what strict clients do.
Is SSL the same as TLS?
TLS is the successor to SSL, and every SSL version is long retired. People still say SSL certificate out of habit. The certificate is the same either way; what changes is the protocol version the server negotiates.
How long are SSL certificates valid?
Let's Encrypt certificates last 90 days. The CA/Browser Forum has voted to shorten the maximum lifetime of all public certificates in steps, down to 47 days by 2029. Shorter lifetimes mean renewal has to be automated and working.
My certificate renewed but the site still shows the old one. Why?
The server loaded the old certificate when it started and keeps serving it until it is reloaded. Reload nginx, Apache or your load balancer, or check that the renewed file is the one the configuration points to.
Do you store the sites I check?
Results are cached for five minutes to protect the checked servers, then discarded. They are not published or indexed.
Stop finding out from your customers
Certificates renew automatically until the day they do not. TinyPing checks your site every 5 minutes and alerts you by email, Slack, webhook or Google Chat when:
- the certificate is 14, 7, 3 or 1 days from expiring
- an expired or broken certificate makes HTTPS fail
- the site returns an error or times out
US$6.99 a month or US$47 a year per 50 monitors, team members free. 7-day free trial, no card needed.
Want alerts in team chat? Follow the guide for Slack or Google Chat.