SSL certificate checker
Check when a website's certificate expires, who issued it and which names it covers, and whether HTTPS, the HTTP-to-HTTPS redirect and HSTS are set up.
Makes one HTTPS and one HTTP request to the homepage, the same as a browser visit, and looks the domain up in public Certificate Transparency logs. Results are not stored in our database.
What this checks
- Whether HTTPS connects with a valid, trusted certificate for the hostname
- HTTP to HTTPS redirect and the HSTS header
- The current certificate's issuer, validity dates, days left and names covered, from Certificate Transparency logs
- Recent certificates issued for the domain, to spot unexpected issuance
Chain completeness, protocol and cipher grading and revocation status are not checked here.
Not checked here
- Certificate chain completeness. Cloudflare Workers cannot read the certificates a server sends, so we cannot see whether intermediate certificates are missing. Some older clients fail on an incomplete chain even when browsers succeed.
- TLS protocol versions and cipher suites. The connection details negotiated by Cloudflare are not exposed to Workers, so no protocol or cipher grade is given.
- OCSP and revocation status. Revocation is not queried. A revoked certificate can still appear valid in Certificate Transparency logs.
- Other servers and ports. Only the hostname on port 443 (and 80 for the redirect) is contacted, from one Cloudflare location. Other IP addresses behind the name, mail servers and custom ports are not checked.
What an SSL/TLS certificate does
A TLS certificate (still often called an SSL certificate) lets browsers confirm they are talking to your website and encrypts the connection. It is issued by a certificate authority for specific names, such as example.com and www.example.com, or a wildcard such as *.example.com that covers one level of subdomains.
Expiry
Every certificate has a fixed validity period. When it ends, browsers show a full-page security warning and most visitors leave. Expiry is one of the most common causes of avoidable outages, usually because automatic renewal silently stopped working.
Certificate Transparency logs
Publicly trusted certificates are recorded in public Certificate Transparency logs. Searching them shows which certificates exist for a domain, who issued them and when they expire, without connecting to the server. It also reveals certificates you did not expect.
Common certificate errors
- Expired certificate - renewal failed or the renewed certificate was never installed.
- Name mismatch - the certificate does not cover the exact hostname, for example it covers example.com but not www.example.com.
- Incomplete chain - the server does not send the intermediate certificate, so some clients cannot verify it.
- Self-signed or private certificate - not issued by a publicly trusted authority.
- No HTTPS redirect or HSTS - visitors who type http:// can stay on an unencrypted connection.
Frequently asked
Is the certificate I see here the one my visitors get?
The live check uses the certificate your server (or CDN) presents to Cloudflare, but Workers cannot read its details. The issuer, dates and names come from Certificate Transparency logs, which record every publicly trusted certificate. If a CDN or load balancer serves its own certificate, the one shown here may be a different, also valid, certificate.
Why does the checker say HTTPS connected when I know my certificate has a problem?
Cloudflare validates the certificate for the hostname and refuses untrusted or expired ones, so a successful connection means the certificate served to Cloudflare was valid at that moment. Problems such as a missing intermediate certificate on some servers, or a different certificate on another IP address, are not visible from here.
How often should I renew?
Most certificates are renewed automatically by your host or by an ACME client such as Certbot. Publicly trusted certificates are getting shorter lifetimes, so automatic renewal matters more each year. Renew well before expiry and confirm the renewal is actually installed.
What is Certificate Transparency?
Certificate authorities publish every certificate they issue to public, append-only logs. Anyone can search them, which makes it possible to spot certificates you did not request. This tool uses the crt.sh search service.
Do you store the domains I check?
No database record is made of the check. The result is kept in Cloudflare's edge cache for about 10 minutes so the share link works, and a hashed counter of your IP address is used for rate limiting.
Can Webforta warn me before a certificate expires?
Yes. Webforta Monitor checks certificate expiry daily for websites you add and shows the days left in your dashboard. On Starter, Pro and Business it also emails you before the certificate expires, and again if it does.
Webforta Monitor alerts you before certificates expire
Add your website and Webforta checks certificate expiry daily, along with uptime, response time, DNS and security-header changes, and warns you before a certificate runs out. Email alerts are included in Starter, Pro and Business.