Test SSL certificate
Just installed or renewed a certificate? Test what the server is actually serving right now — issuer, expiry, chain, and every field, free and instant.
Related tools: Check SSL certificate · Validate SSL certificate · Is my website down?
A live read of the certificate a server presents
An SSL test opens a real TLS connection to a hostname on port 443 and reads back the certificate the server presents — the same handshake every browser performs before it will load the page. It confirms the certificate in production is the one you meant to deploy: the expected issuer, a validity window that has started and not ended, names that cover the hostname, and a chain that reaches a trusted root.
This check reflects the certificate the server is serving at this moment. For continuous coverage — so you find out the moment a certificate is renewed wrong or left to expire, not the next time you happen to check — Upcheck monitors it automatically every 12 hours.
Three steps, no signup
- 01
Enter a hostname
Type a domain — with or without https:// — and submit it. No account, no install.
- 02
We open a real TLS connection
The checker connects on port 443 and reads the certificate the server actually presents, the same way a browser does.
- 03
Full certificate detail comes back
Issuer, validity window, SANs, key size, and fingerprint — not just a pass/fail.
Frequently asked questions
How do I test if my SSL certificate is working?
Enter the hostname above and run the test. The tool opens a fresh TLS connection from outside your network and shows the certificate the server presented on that handshake. That matters because your own browser is a poor test instrument: it caches certificates, keeps connections open across a renewal, and will happily show a padlock on a session negotiated before your change. A fresh external handshake is the honest answer.
I just renewed my certificate — why does the test still show the old one?
Because the server is still serving the old one. The renewal creating a new certificate and the server presenting it are two separate steps, and the second fails quietly all the time: the web server was never reloaded, a load balancer or CDN is still holding the old certificate, or the config points at the old file path. This gap — renewal succeeded, deployment didn't — is exactly what a live test catches. Reload the service and test again.
Does this test check the full certificate chain?
Yes. The test reads the chain the server sends, from the leaf through the intermediates. A server that omits an intermediate can look fine from your machine — browsers cache intermediates they have seen before — while failing for first-time visitors and most API clients. That is why 'works in my browser, fails for customers' is so often a chain problem, and why the chain is part of every test here.
Can I test a certificate before DNS points at the server?
No — this tool resolves the hostname the way any visitor would and connects to whatever DNS currently returns, so it always tests the live server. To test a certificate on a box DNS doesn't point at yet, run openssl s_client -connect <ip>:443 -servername <hostname> against the new server directly, then use this test after cutover to confirm the switch took.
How often should I test my SSL certificate?
By hand: after every install, renewal, or infrastructure change that touches TLS — that is when the wrong-certificate and broken-chain mistakes happen. Beyond that, testing on a schedule is what monitoring is for: Upcheck re-runs this same handshake on every hostname automatically every 12 hours and alerts your team when a certificate is about to expire, fails validation, or changes when nobody deployed.
Is this SSL test really free?
Yes. Testing a certificate here costs nothing and needs no account, however many hostnames you test. Automated or scripted use is rate limited to keep the tool fast for everyone testing by hand. Signing up is only for monitoring — having the test re-run automatically and a human alerted before the result changes for the worse.
One check tells you now. Monitoring tells you before it matters again.
Add your hostnames to Upcheck and get alerted by email, Slack, Discord, Teams, or webhook — well before the next certificate lapses.