SSL Certificate Checker

This tool queries crt.sh (Certificate Transparency logs) to show the most recently issued SSL/TLS certificate for a domain. You can see the certificate subject, issuer, validity dates, days remaining until expiry, and Subject Alternative Names (SANs) — all the domains the certificate covers.

Enter your domain name and click Check Certificate. The tool will display the Not Before and Not After dates, plus a countdown of days remaining. Certificates with fewer than 30 days are highlighted as expiring soon. Expired certificates show a red warning. You can also check with curl: run 'curl -vI https://yourdomain.com 2>&1 | grep -A5 expire' or use openssl: 'echo | openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates'.

SANs are additional domain names (and sometimes IP addresses) that a single certificate covers. A certificate for example.com might also include www.example.com, api.example.com, and *.example.com. Modern browsers and the CA/Browser Forum require the hostname to appear in the SAN field — the Common Name (CN) alone is no longer sufficient for HTTPS.

Certificate Transparency is a public framework that requires Certificate Authorities (CAs) to log every SSL/TLS certificate they issue to a public, append-only ledger. This makes it possible to detect misissued or fraudulent certificates. crt.sh is a free public search engine built on top of CT logs — it indexes all publicly logged certificates.

The process depends on your setup: if you're using Let's Encrypt with Certbot, run 'certbot renew'. On cloud platforms like Cloudflare, AWS ACM, or Vercel, certificates auto-renew. For manually managed certs, generate a new CSR, purchase from a CA, install the new cert, and restart your web server. Let's Encrypt certificates last 90 days — automate renewal with a cron job or use auto-renewal hooks.

DV (Domain Validation) only verifies you control the domain — fastest and cheapest, used by Let's Encrypt. OV (Organization Validation) also verifies your organization is real — shows org name in cert details. EV (Extended Validation) requires rigorous vetting — historically showed the green address bar in browsers, though most browsers have removed this visual distinction. For most websites, DV (Let's Encrypt) is sufficient.

Certificate validity is necessary but not sufficient for a green padlock. Common reasons for browser warnings despite a valid cert: (1) Mixed content — some page resources (images, scripts) are loaded over HTTP. (2) Incomplete chain — intermediate CA certificates are missing. (3) Certificate name mismatch — the domain doesn't match any SAN. (4) HSTS preload issues. Check browser DevTools Security tab for the exact error.