SSL Certificate Checker

Enter a domain to check its SSL/TLS certificates via Certificate Transparency logs.

Connection

Certificates (from CT Logs)

About SSL Certificate Checking

This tool queries Certificate Transparency logs via crt.sh to find SSL/TLS certificates issued for a domain. It also tests whether the domain is reachable over HTTPS.

  • Certificate Transparency is a public framework for monitoring and auditing SSL certificates
  • Expired certificates are flagged in red
  • Results show the 20 most recent unique certificates

A certificate that is valid today is not the interesting question; the interesting question is what happens in ninety days. Automated issuance has made short lifetimes normal, so most outages now come from renewal that stopped working rather than from a certificate that was never valid. Check the chain as well as the leaf: a server that sends its certificate without the intermediate will work in a browser that has cached it and fail everywhere else.

Related tools

HTTP Header Inspector DNS Lookup WHOIS Lookup

How are you actually storing that?

Hashes, tokens and passwords are only as strong as the code around them: a cost factor left at the default, a token nobody checks the expiry on, a secret committed to the repository. We review and harden applications, and we tell you what an attacker reaches first.

Book a security review

Frequently Asked Questions

My certificate works in Chrome but fails elsewhere. Why?
Almost always a missing intermediate. A browser that has seen the intermediate before caches it and completes the chain on its own; a fresh client, a mobile app or curl has no such luck. Serve the full chain from the server.
How long before expiry should I renew?
Automate it and stop thinking in weeks. If you cannot, renew at a third of the lifetime remaining, so a ninety day certificate is replaced with thirty days to go. That leaves room for a failed renewal without an outage.
What is certificate transparency?
A set of public logs that every certificate is written into. It means you can see certificates issued for your domains, including ones you did not ask for, which is the quickest way to notice that someone else obtained one.
Does a valid certificate mean the site is safe?
No. It means the connection is encrypted and the name matches. Anyone can obtain a certificate for a domain they control, including someone running a phishing site, so a padlock says nothing at all about who is behind it.
Why does the name not match?
The certificate covers a list of names and the one you visited is not among them. A wildcard covers one level only, so a certificate for *.example.com does not cover a.b.example.com.