TLS certificate checker
Inspect an HTTPS certificate’s expiration date and verification result. Check renewal timing and domain configuration.
Quick start
- Enter the HTTPS hostname.
- Review dates, names, and verification.
- Investigate the setting identified by an error.
Read the certificate
| Field | What to check |
|---|---|
| Validity dates | Check both the start and end date. Remaining days are rounded down. |
| SAN / hostname | Check whether the certificate covers the requested name. |
| Verification | Based on this server’s trust store and TLS environment; read the associated error. |
| TLS version and cipher | Values negotiated for this connection, not a full list of supported combinations. |
What a certificate confirms
A certificate binds a name to a public key; TLS protects the connection. A valid certificate does not establish that a site’s content or operator is trustworthy.
After renewal
This checker connects on port 443 and caches results for up to 15 minutes. A CDN or proxy may serve a different certificate from the origin server.
Use the actual hostname and verify what the live TLS endpoint serves. Do not assume every certificate lasts 90 days; check its real dates and renewal logs.
Verification failures
If verification fails, the tool may make a second, unverified connection to read the certificate. Reading it does not make it trusted. Expiration, name mismatch, and trust-chain problems require different fixes.
Checking a certificate with openssl
openssl can also show the certificate a server actually presents. -servername sets SNI, which you need to get the right certificate when one server hosts several domains.
$ echo | openssl s_client -connect pport.cloud:443 -servername pport.cloud 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
subject=CN=pport.cloud
issuer=C=US, O=Let's Encrypt, CN=YE1
notBefore=Aug 15 15:49:39 2026 GMT
notAfter=Nov 13 15:49:38 2026 GMT
X509v3 Subject Alternative Name:
DNS:pport.cloudnotBefore and notAfter are 90 days apart and the issuer is Let’s Encrypt. Such certificates are usually renewed automatically from 30 days before expiry, so if less than a month remains and the dates have not moved, check the renewal job.
Checking certbot automatic renewal
sudo certbot certificates
sudo certbot renew --dry-run
systemctl list-timers | grep -i certbotcertbot certificates lists each certificate’s expiry date and file paths, and renew --dry-run tests the renewal without changing anything. The timer is named certbot.timer or snap.certbot.renew.timer depending on how certbot was installed. Even after a successful renewal, the web server must reload the new files before the new certificate is served, so check the expiry date with this tool again afterwards.