A client tells you their site shows "connection not secure". A coworker asks if a server's certificate is still valid. Or you simply want to check your own site's security setup before Google Search Console flags it as an issue. Checking a domain's real SSL status in seconds saves you the step of logging into the hosting panel to check manually.
What an SSL checker verifies
- Issuer: which certificate authority issued the certificate.
- Expiry: the exact date it stops being valid. An expired certificate triggers security warnings in every browser.
- SANs (Subject Alternative Names): every domain and subdomain the certificate covers.
- Protocol: which TLS version the server uses (TLS 1.2, 1.3...). Older versions (TLS 1.0, 1.1) are considered insecure and many browsers no longer accept them.
- Security grade (A+ to F): a score summarizing the overall configuration: protocol, supported ciphers, and whether any known vulnerabilities exist in the setup.
How to check a domain's SSL
- Enter the domain you want to check.
- The tool connects and analyzes the certificate in use.
- Review the issuer, expiry, SANs, protocol and grade.
You can do it free with the SSL Checker on this site.
Why expiry is the most common and most avoidable failure
Modern SSL certificates (like Let's Encrypt's) usually renew automatically, but when something breaks in that automatic process—a server change, a broken renewal configuration—the certificate simply expires without anyone noticing until a visitor sees the "not secure" warning. Checking it periodically, especially after any infrastructure change, keeps that warning from being the first sign of a problem.
What the A+ to F grade means
The grade summarizes in a single letter the quality of the server's TLS configuration, not just whether the certificate is valid. A site can have a valid certificate and still get a low grade if, for example, it still accepts old, insecure protocols for compatibility, or uses weak ciphers. For most sites, targeting TLS 1.2 as a minimum (ideally 1.3) and disabling old protocols is what makes the difference between a high grade and a mediocre one.
Difference from the certificate decoder
This tool connects to the domain and analyzes the certificate the server is serving right now, including the TLS protocol and security grade. If instead you already have the certificate file (a .pem) and just want to read its fields without connecting to any server, the x.509 certificate decoder does exactly that.
Frequently asked questions
How far in advance should I check expiry? If your certificate renews automatically, an occasional check is enough; if it's manual, check a few weeks before expiration.
What TLS protocol should my site have at minimum? TLS 1.2 as a minimum, with TLS 1.3 as a goal; earlier protocols are considered obsolete and insecure.
Does a low grade mean my site is unsafe for users? Not necessarily unsafe, but it does indicate room for improvement in the server's configuration against current recommended practices.
Do I need server access to check this? No, the tool only needs the domain; all certificate information is public by the very way HTTPS works.
Check any website's SSL certificate for free with the SSL Checker, with an A+ to F security grade in real time.