Free tool · no signup
Is your SSL certificate about to expire?
Enter a domain and see the real certificate the server presents: expiry date, issuer, every hostname it covers, and whether browsers will actually trust it.
What this checks
The tool opens a real TLS connection to port 443 and reads the certificate the server presents — the same one your visitors get. It deliberately does not stop at the first error, because an expired or mismatched certificate is exactly the case worth reporting.
- Expiry. Days remaining, with a warning inside 30 days and an alarm inside 7.
- Hostname match. Including correct wildcard depth —
*.example.comdoes not covera.b.example.com. - Issuer. Who vouches for it, and whether it is self-signed (which every browser rejects).
- Key strength. Flags keys below the modern 2048-bit RSA minimum.
Nothing is stored and nothing is sent anywhere. The check runs from our server, so it sees what the public internet sees rather than what your browser has cached.
Common questions
How long before expiry should I renew an SSL certificate?
At least 30 days. Most certificates auto-renew at that point, so if you are inside 30 days and nothing has happened, the renewal is failing silently — which is how sites end up down on a Saturday morning.
What does "hostname does not match" actually mean?
The certificate is valid, but not for the address the visitor typed. It usually happens when a certificate covers example.com but not www.example.com, or when a wildcard is expected to cover a sub-sub-domain. Browsers treat it exactly like an invalid certificate: a full-page warning.
Does a wildcard certificate cover every subdomain?
Only one level. A certificate for *.example.com covers shop.example.com but NOT eu.shop.example.com. This catches people out constantly, so this tool checks the depth properly rather than just matching the suffix.
My certificate is valid. Does that mean my site is secure?
No. A certificate encrypts traffic between the browser and the server. It says nothing about whether the application is vulnerable to broken access control, injection, or business-logic flaws — which is what actually gets sites breached, and what a manual audit looks for.
Keep reading
See what attackers see — free
Run the free passive check on your domain. No login, no impact on your site, results in seconds.
Ready for the full manual audit? See transparent pricing →