netlupaCheck a website's SSL certificate
Enter a domain to check whether its HTTPS certificate is valid, how many days it has left and which names it covers.
How to check an SSL certificate
Enter the website's domain (or paste its URL). For another service, add the port: :465 (SMTP), :993 (IMAP)…
Click «Check»: we connect the way a browser would and read the certificate.
Check whether it is valid, how many days it has left and whether it covers every name you use (with and without www).
What an SSL (TLS) certificate is
The certificate is the digital document that lets a website use HTTPS. It does two things: it encrypts the connection between your browser and the server, and it proves the server really belongs to the domain you typed and is not an impostor.
It is issued by a certificate authority (Let's Encrypt, DigiCert, Sectigo, Google Trust Services…) after checking that whoever requests it controls the domain. Although people still say «SSL», the current protocol is TLS: SSL has been obsolete for years.
Why a certificate stops being valid
- Expiry: every certificate expires. Let's Encrypt certificates last 90 days, and the maximum lifetime of any certificate is being cut in stages down to 47 days. Renewing them automatically is the norm.
- Name mismatch: a certificate for example.com does not work for www.example.com unless it includes it in its list of names (or is a *.example.com wildcard).
- Incomplete chain: the server must also send the intermediate certificates. If one is missing, some browsers and almost every program fail.
- Self-signed: generated by the server itself, with no authority behind it. Fine for testing, not for a public website.
- Revoked: the issuer has cancelled it, for example because the private key leaked.
What to look at in the result
- Days left: if fewer than two weeks remain and renewal is automatic, something is failing.
- Names covered: make sure every name you use is there, with and without www, plus subdomains.
- Issuer: tells you which authority signed it and therefore where it is renewed.
- Public key: RSA of 2048 bits or more, or ECDSA (faster with the same security).
- Protocol: TLS 1.3 or 1.2. Versions 1.0 and 1.1 are retired and browsers no longer support them.
For email and other services too
Mail, LDAP and encrypted DNS servers use the same certificates. Add the port to the domain to check them:
- 465: mail submission (SMTP over TLS).
- 993: IMAP over TLS.
- 995: POP3 over TLS.
- 636: LDAP over TLS.
- 853: DNS over TLS.
- 8443: alternative web panels.
For security we only allow these ports and never connect to private addresses.
Frequently asked questions
How do I know when my website's certificate expires?
Enter your domain in the tool: you will see the exact date and the days left. In your browser you can also see it by clicking the padlock next to the address.
The site works in my browser but here the chain is not trusted. Why?
It is usually an incomplete chain: some browsers fetch the missing intermediate on their own, but many programs, mobile apps and servers do not. Configure your server to send the certificate together with its full chain (fullchain).
Is a free certificate less secure than a paid one?
No. The encryption is the same. Paid ones may include company validation (OV/EV), warranties or support, but browsers treat them exactly like a Let's Encrypt one.
What is a wildcard certificate?
One issued for *.example.com, which works for any one-level subdomain (www, shop, mail…), but not for plain example.com or for sub.sub.example.com unless they are added separately.