How to use
- Enter a domain, adding a port if needed, e.g. example.com:8443.
- Click Look up to see whether it is valid, the days left and certificate details.
- If there is a problem, check that the certificate covers the domain, has not expired and that intermediates are installed.
Options explained
- Valid
- The chain verifies to a root trusted by common browsers, the certificate covers the domain and is within its validity period.
- Days left
- Let’s Encrypt certificates last 90 days and usually renew 30 days before expiry; under 14 days is highlighted.
- Certificate chain
- Servers should send intermediate certificates along with the site certificate; without them some clients, especially Android and API calls, fail.
Reading the result
The banner at the top shows whether the certificate is valid and how many whole days remain, rounded down. It is green when the certificate is valid with 14 or more days left, yellow when it is valid but has fewer than 14 days left, and red when there is a problem. An expired certificate shows how many days ago it expired.
| Message | Usual cause | What to check |
|---|---|---|
| The certificate does not cover this domain | The name you entered is not in the Covered names list | Reissue the certificate with the right name, or check that the server answers with the right site for this name, for example in the virtual host or SNI configuration |
| Expired or not yet valid | Today is outside the Valid from – to dates | Renew; if the dates look right, check the clock of the machine running the server |
| Untrusted issuer or incomplete chain | The server did not send an intermediate certificate, or the issuer is not a public CA | Look at the Certificate chain list: it should contain the site certificate followed by its intermediates. Install the full chain file |
| No certificate was presented | The TLS handshake finished without the server sending a certificate | Check the server’s TLS configuration and that the right port is used, for example example.com:8443 |
Covered names are the subject alternative names. A wildcard such as *.example.com covers www.example.com but not example.com itself or a.b.example.com, so the bare domain must be listed separately.
The checker connects with the name you typed as the server name, so a server that hosts several sites returns the certificate for that name. The Protocol row shows the negotiated TLS version and cipher suite for this one connection, not every version the server supports.
Frequently asked questions
The browser opens the site — why an incomplete chain?
Many browsers fill in or cache missing intermediates, but programs, API clients and some phones do not. Serve the fullchain file (including intermediates) to fix it.
Can I check ports other than 443?
Ports 443, 8443, 8080 and 80 are allowed; add :port after the domain.
Is revocation checked?
No. Only the chain, validity dates and names are checked.
Privacy
This tool needs our server: what you enter or upload is sent over HTTPS, processed and then discarded, never stored. Server access logs record IP addresses and request URLs, used only to prevent abuse.