SSL certificate check

Check when your certificate expires, whether the chain is complete, and which protocol versions you still accept. One URL, no account.

We complete a TLS handshake the way a browser does, and read what your server presents.

What this check actually verifies

Most certificate problems are not expiry — they are an incomplete chain that works in your browser because it happens to have the intermediate cached, and fails on a phone that does not. This check completes the handshake from outside and reports what a first-time visitor would get.

Days to expiry
With the renewal window, not just the date. Under 21 days is urgent.
Chain completeness
Whether the intermediates are actually served, not merely valid.
Protocol versions
TLS 1.2 and 1.3 accepted; anything older is a finding.
Hostname and SAN match
Including the www and apex variants people actually type.

What a result looks like

41 days

Until expiry

Auto-renewal last ran 62 days ago.

TLS 1.3

Highest protocol

TLS 1.0 and 1.1 correctly refused.

Missing intermediate

Works in Chrome, fails on older Android.

The report states which certificate, which host it was served for, and which clients would reject it. A pass or fail badge would hide the case that matters most: the site that works everywhere except on your customers phones.

A check tells you about today. Monitoring tells you at 04:00.

Certificates expire at the least convenient hour, and renewal automation fails silently — a changed DNS record, a rate limit, a cron that stopped. Monitoring counts down every certificate you have and raises the alarm weeks early, then confirms the new one is actually being served.

Track every certificate continuously See what that costs

Common questions

Is this the same engine as the paid monitoring?: Yes — the same checks, run the same way. The difference is that monitoring repeats them on a schedule and keeps the history, which is what turns a number into a trend and a trend into an alert.
Does testing my site slow it down or change anything?: No. Everything is read from the outside, the way a visitor arrives — no agent, no script on your pages, nothing written. Our requests identify themselves so you can recognise them in your own logs.
My certificate renews automatically. Do I need this?: Automation is exactly why. Renewal that has worked for two years fails on the day a DNS record changes, and the failure is silent until a browser shows the warning. This is the check that notices the gap between renewed and served.

Related tests

A free test is a snapshot. Monitoring is the product.

What this check actually verifies

Days to expiry

With the renewal window, not just the date. Under 21 days is urgent.

Chain completeness

Whether the intermediates are actually served, not merely valid.

Protocol versions

TLS 1.2 and 1.3 accepted; anything older is a finding.

Hostname and SAN match

Including the www and apex variants people actually type.

What a result looks like

41 days

Until expiry

Auto-renewal last ran 62 days ago.

TLS 1.3

Highest protocol

TLS 1.0 and 1.1 correctly refused.

Missing intermediate

Works in Chrome, fails on older Android.

Common questions

Is this the same engine as the paid monitoring?

Yes — the same checks, run the same way. The difference is that monitoring repeats them on a schedule and keeps the history, which is what turns a number into a trend and a trend into an alert.

Does testing my site slow it down or change anything?

No. Everything is read from the outside, the way a visitor arrives — no agent, no script on your pages, nothing written. Our requests identify themselves so you can recognise them in your own logs.

My certificate renews automatically. Do I need this?

Automation is exactly why. Renewal that has worked for two years fails on the day a DNS record changes, and the failure is silent until a browser shows the warning. This is the check that notices the gap between renewed and served.