# SSL Certificate Checker

> Check a domain's SSL certificate: issuer, valid-from and expiry dates, days left and covered names, plus a live HTTPS test and HTTP to HTTPS redirect check.

Use it free at https://swipetolaunch.com/tools/ssl-certificate-checker

## How to use it

1. **Enter a domain.** The hostname visitors use, like example.com or www.example.com.
2. **Check.** We read the public Certificate Transparency logs and make a live HTTPS request to the site.
3. **Read the result.** Days until expiry, the issuing CA, every name on the certificate, and whether HTTP upgrades to HTTPS.

## How this check works

A browser sees a site's certificate during the TLS handshake. Our checker runs on Cloudflare Workers, which cannot read that handshake directly, so it uses two other sources:

1. **Certificate Transparency logs.** Every publicly trusted certificate must be published to CT logs before browsers accept it. We search them (via crt.sh, with Cert Spotter as a fallback) for current certificates that cover your hostname, including wildcards.
2. **A live HTTPS request.** If the certificate were expired, self-signed or issued for the wrong name, the request would fail the way a browser does. We also request the `http://` version to confirm it redirects to HTTPS.

Seeing several current certificates is normal. CDNs like Cloudflare often hold certificates from two authorities at once, and renewals overlap with the old certificate.

## Why it matters

An expired certificate turns your site into a full-page browser warning, and almost every visitor leaves. HTTPS is also a confirmed, if small, Google ranking signal, and Chrome labels HTTP pages "Not secure".

## Keeping certificates healthy

- **Automate renewal.** Let's Encrypt and Google Trust Services certificates last 90 days and are meant to renew automatically, around 30 days before expiry. Certificate lifetimes across the industry are shrinking, so manual renewal is getting harder to keep up with.
- **Cover every hostname.** The certificate's names (SANs) must include each hostname you serve, such as both `example.com` and `www.example.com`.
- **Redirect HTTP to HTTPS** with a single 301, then send an HSTS header so browsers never try HTTP again.
- **Check your CAA record.** If you set one, it must list your certificate authority, or renewals fail. See it with the [DNS lookup](/tools/dns-lookup).

Check HSTS and other security headers with the [HTTP header checker](/tools/http-header-checker).

## What you get

- Expiry date and days left
- Issuer and every covered name
- Wildcard certificates matched
- Live HTTPS and HTTP to HTTPS checks
- HSTS check

## Questions

### How do I check when an SSL certificate expires?

Enter the domain above. We find its current certificates in the public Certificate Transparency logs and show the expiry date and days left for each.

### Why does it show more than one certificate?

Sites behind a CDN often have certificates from two authorities at once, and a renewed certificate is issued before the old one expires. Browsers use whichever the server presents. All current ones are listed.

### Is SSL the same as TLS?

SSL is the old name. Every modern site uses TLS, but "SSL certificate" stuck as the everyday term for the certificate that enables HTTPS.

### Does HTTPS affect SEO?

Yes, a little. Google has used HTTPS as a lightweight ranking signal since 2014, and Chrome marks HTTP pages as not secure, which hurts trust and conversions.

### Why can you not read the certificate directly?

This tool runs on Cloudflare Workers, which do not expose the peer certificate of an outbound connection. Certificate Transparency logs hold the same public certificate data, and our live HTTPS request confirms the site serves a valid one.