Check SSL certificate
Enter a hostname to read and verify the SSL certificate it's actually serving right now — issuer, expiry, chain, and every field — and whether it validates. A free online check, no signup.
Related tools: All free tools
A live read of the certificate a server presents
An SSL certificate check opens a real TLS connection to a hostname on port 443 and reads the certificate the server presents, the same handshake a browser performs. It returns the certificate's issuer, validity window, subject alternative names, key type and size, signature algorithm, and SHA-256 fingerprint — a live, one-time read of what that server is serving at the moment you check. It also runs the checks a browser runs before trusting a certificate, so the same read works as a validator: it tells you whether the certificate validates and whether the one you just installed is the one being served.
This check reflects the certificate the server is serving at this moment. For continuous coverage — so you find out the moment a certificate is renewed wrong or left to expire, not the next time you happen to check — Upcheck monitors it automatically every 12 hours.
Three steps, no signup
- 01
Enter a hostname
Type a domain — with or without https:// — and submit it. No account, no install.
- 02
We open a real TLS connection
The checker connects on port 443 and reads the certificate the server actually presents, the same way a browser does.
- 03
Full certificate detail comes back
Issuer, validity window, SANs, key size, and fingerprint — not just a pass/fail.
Validate the certificate, not just read it
A certificate is valid when four things hold at once: it was issued by an authority the client trusts, the chain from the server's certificate up to that authority's root is complete, the hostname being visited is listed in the common name or subject alternative names, and today's date falls inside the validity window. Fail any one and browsers show a full-page warning. Validity is not a score, it is a conjunction.
The most common failure is a missing intermediate. Your certificate is signed by an intermediate authority, which is signed by a root that operating systems and browsers ship with, and the server is responsible for sending the intermediates. A server that doesn't can still look fine from your machine, because browsers cache intermediates they've seen elsewhere, while failing for first-time visitors, older devices, and most API clients. The checker reads the chain the server actually sends and reports the underlying error alongside the verdict, so you can tell which of the four checks failed.
Test a certificate after an install or renewal
Your own browser is a poor test instrument: it caches certificates, keeps connections open across a renewal, and will happily show a padlock on a session negotiated before your change. This checker opens a fresh TLS connection from outside your network, so what it shows is what a first-time visitor gets.
The renewal creating a new certificate and the server presenting it are two separate steps, and the second fails quietly all the time: the web server was never reloaded, a load balancer or CDN is still holding the old certificate, or the config points at the old file. If the checker still shows the old expiry date after a renewal, that gap is the reason. Reload the service and check again.
The checker resolves the hostname the way any visitor would, so it always tests the live server. To test a certificate on a box DNS doesn't point at yet, run openssl s_client -connect <ip>:443 -servername <hostname> against the new server directly, then use this checker after cutover to confirm the switch took.
Frequently asked questions
How do I check an SSL certificate?
Type a hostname into the box above — a bare domain like example.com, or one with https:// in front — and click Check certificate. Upcheck opens a real TLS connection to the host and reads back the certificate it presents: issuer, expiry date, SANs, key size, and the rest, usually within a couple of seconds.
Is this SSL checker really free?
Yes. Checking a certificate here costs nothing and needs no account. Signing up is only for ongoing monitoring — having Upcheck re-check a hostname automatically every 12 hours and alert your team before its certificate expires.
Can I check any website, or only ones I own?
You can check any publicly reachable hostname's certificate, the same as opening it in a browser and clicking the padlock — you don't need to own it. Checks against non-public names like *.local or *.internal aren't supported, since those aren't reachable from the public internet this tool checks over.
What makes an SSL certificate valid?
Four things at once: it was issued by a certificate authority the client trusts, the chain from the server's certificate up to that authority's root is complete, the hostname being visited is listed in the certificate's common name or subject alternative names, and the current date is inside the notBefore/notAfter window. Fail any one and browsers show a full-page warning.
How do I verify an SSL certificate?
Verifying is the same read as checking, judged against those four rules: enter the hostname above and Upcheck opens a real TLS connection, reads the certificate, and reports whether a browser would accept it — trusted issuer, complete chain, hostname covered, current date inside the validity window — with the underlying error when one of them fails. It is the same verification a browser performs on every visit, run online from outside your network, so your own cache and already-open connections can't mask the answer.
Why does the tool show 'Host unreachable' or 'Invalid'?
Unreachable means the TLS handshake never completed — the host is down, DNS doesn't resolve, or nothing is listening on port 443. Invalid means a certificate came back but failed validation. The usual suspects, roughly in order: the server isn't sending an intermediate, so the chain doesn't reach a trusted root; the certificate doesn't cover the exact hostname — issued for www.example.com but visitors hit example.com bare, or a subdomain outside the wildcard; the validity window has ended, or hasn't started because a server clock is wrong; or the certificate is self-signed. Both verdicts are shown with the underlying error so you can see exactly what failed.
Can this check a self-signed certificate?
It will read one and report it as failing validation, because its root isn't in any public trust store — which is the correct verdict for anything public visitors reach. Self-signed certificates are legitimate for internal services where you control the clients and can distribute the root yourself; on the public internet they produce the same browser warning as any other invalid certificate.
I just renewed my certificate — why does the check still show the old one?
Because the server is still serving the old one. The renewal creating a new certificate and the server presenting it are two separate steps, and the second fails quietly all the time: the web server was never reloaded, a load balancer or CDN is still holding the old certificate, or the config points at the old file path. Reload the service and check again.
Can I check a certificate before DNS points at the server?
No — this tool resolves the hostname the way any visitor would and connects to whatever DNS currently returns, so it always checks the live server. To test a certificate on a box DNS doesn't point at yet, run openssl s_client -connect <ip>:443 -servername <hostname> against the new server directly, then use this checker after cutover to confirm the switch took.
Does a valid certificate mean my site is secure?
No — it means something narrower and still important: traffic between the visitor and the server presenting this certificate is encrypted, and the certificate for this hostname was issued by a trusted authority. It says nothing about the application behind it. Validation is a floor, not a ceiling; a phishing site can have a perfectly valid certificate.
If I can check for free, why would I need certificate monitoring?
A single check is a snapshot of one moment. Certificates change — they get renewed, they get renewed wrong, or a validation step silently breaks and nobody notices until expiry takes the site down. Check by hand after every install, renewal, or infrastructure change that touches TLS. Beyond that, monitoring re-runs this same check automatically every 12 hours and alerts a person before it matters, which a one-off check can't do.
Is there a limit to how many certificates I can check?
You can check as many hostnames as you like. Automated or scripted use is rate limited to keep the tool fast and available for everyone checking manually.
One check tells you now. Monitoring tells you before it matters again.
Add your hostnames to Upcheck and get alerted by email, Slack, Discord, Teams, or webhook — well before the next certificate lapses.