SSL Certificate Checker

This tool queries crt.sh (Certificate Transparency logs) to show the most recently issued SSL/TLS certificate for a domain. You can see the certificate subject, issuer, validity dates, days remaining until expiry, and Subject Alternative Names (SANs) — all the domains the certificate covers.

Certificate Transparency is a public framework that requires Certificate Authorities (CAs) to log every SSL/TLS certificate they issue to a public, append-only ledger. This makes it possible to detect misissued or fraudulent certificates. crt.sh is a free public search engine built on top of CT logs — it indexes all publicly logged certificates.

SANs are additional domain names (and sometimes IP addresses) that a single certificate covers. A certificate for example.com might also include www.example.com, api.example.com, and *.example.com. Modern browsers and the CA/Browser Forum require the hostname to appear in the SAN field — the Common Name (CN) alone is no longer sufficient.

The process depends on your setup: if you're using Let's Encrypt with Certbot, run `certbot renew`. On cloud platforms like Cloudflare, AWS ACM, or Vercel, certificates auto-renew. For manually managed certs, generate a new CSR, purchase from a CA, install the new cert, and restart your web server. Let's Encrypt certificates last 90 days — automate renewal with a cron job.

Certificate validity is necessary but not sufficient for a green padlock. Common reasons for browser warnings despite a valid cert: (1) Mixed content — some page resources (images, scripts) are loaded over HTTP. (2) Incomplete chain — intermediate CA certificates are missing. (3) Certificate name mismatch — the domain doesn't match any SAN. (4) HSTS preload issues. Check browser DevTools for the exact error.

DV (Domain Validation) only verifies you control the domain — fastest and cheapest, used by Let's Encrypt. OV (Organization Validation) also verifies your organization is real — shows org name in cert details. EV (Extended Validation) requires rigorous vetting — historically showed the green bar in browsers, though most browsers have removed this visual distinction. For most websites, DV (Let's Encrypt) is sufficient.