Why SSL Certificate Checking Matters
When an SSL/TLS certificate expires, browsers display a full-page warning — "Your connection is not private" — that blocks access to your site. For businesses, this means lost revenue, broken APIs, and support tickets. Let's Encrypt certificates expire after 90 days. Commercial certificates expire in 1 year. Without active monitoring, expiration dates slip through. A checker that inspects the live certificate tells you exactly how many days remain and whether the chain of trust is intact.
What to Check
- Expiry date: How many days until the certificate expires. Renew at least 7–14 days before expiry to leave buffer for propagation and re-deployment.
- Issuer: Which CA issued the certificate — Let's Encrypt, DigiCert, Sectigo, ZeroSSL, etc. This tells you where renewal happens.
- SAN coverage: Which domains and subdomains the certificate covers. A mismatch between SANs and the actual domain triggers browser warnings.
- Chain completeness: Whether the full certificate chain (leaf → intermediate → root) is properly served. Missing intermediates cause errors on some clients.
- Signature algorithm: SHA-256 is standard. SHA-1 certificates are rejected by modern browsers. ECDSA certificates are faster but less universally supported.
- Key strength: RSA keys should be at least 2048 bits. 1024-bit keys are considered broken.
Common Certificate Problems
- Expired certificate: Most common and most damaging. Automated renewal with Let's Encrypt via certbot or Caddy is the best defense.
- Name mismatch: Certificate is for example.com but user visited www.example.com (or vice versa). Always include both root and www in SANs.
- Incomplete chain: Server serves the leaf certificate but not the intermediate. Browsers cache intermediates so it might work for some users and fail for others — worst case to debug.
- Self-signed certificate: Fine for internal/development use but triggers browser warnings for public sites. Always use a CA-signed certificate for production.
- Revoked certificate: CA has marked this certificate as no longer trusted. Check CRL or OCSP status.
Check Any Site's SSL Certificate
Use ToolsVito's SSL Certificate Checker to inspect any domain's live SSL/TLS certificate. See issuer, expiry date with countdown, SANs, chain completeness, and key strength — all on one page.