Validate SSL certificate
Check whether the certificate a hostname serves is actually valid — trusted issuer, complete chain, matching names, live dates — free and instant.
Related tools: Check SSL certificate · Test SSL certificate · Is my website down?
A live read of the certificate a server presents
Validating an SSL certificate means checking the things a browser checks before it trusts one: the certificate was signed by a trusted authority, the chain from leaf to root is complete and in order, the hostname is covered by the common name or a subject alternative name, and today's date falls inside the validity window. This tool runs that validation against the certificate the server actually presents on a live handshake, and reports the underlying error when a check fails.
This check reflects the certificate the server is serving at this moment. For continuous coverage — so you find out the moment a certificate is renewed wrong or left to expire, not the next time you happen to check — Upcheck monitors it automatically every 12 hours.
Three steps, no signup
- 01
Enter a hostname
Type a domain — with or without https:// — and submit it. No account, no install.
- 02
We open a real TLS connection
The checker connects on port 443 and reads the certificate the server actually presents, the same way a browser does.
- 03
Full certificate detail comes back
Issuer, validity window, SANs, key size, and fingerprint — not just a pass/fail.
Frequently asked questions
What makes an SSL certificate valid?
Four things at once: it was issued by a certificate authority the client trusts, the chain from the server's certificate up to that authority's root is complete, the hostname being visited is listed in the certificate's common name or subject alternative names, and the current date is inside the notBefore/notAfter window. Fail any one and browsers show a full-page warning — validity is not a score, it is a conjunction.
Why does my certificate show as invalid?
The usual suspects, roughly in order: the server isn't sending an intermediate certificate, so the chain doesn't reach a trusted root; the certificate doesn't cover the exact hostname — issued for www.example.com but visitors hit example.com bare, or a subdomain outside the wildcard; the validity window has ended, or hasn't started because a server clock is wrong; or the certificate is self-signed. The tool shows the underlying error alongside the verdict so you can tell which case you're in.
What is a certificate chain, and why does it break validation?
Your certificate is signed by an intermediate authority, which is signed by a root that operating systems and browsers ship with. Clients trust the root, so they need the full path to it — and the server is responsible for sending the intermediates. A server that doesn't can still look fine from your machine, because browsers cache intermediates they've seen elsewhere, while failing for first-time visitors, older devices, and most API clients. That asymmetry is why chain problems are found by validation tools rather than by the person who deployed them.
Can this validate a self-signed certificate?
It will read one and report it as failing validation, because its root isn't in any public trust store — which is the correct verdict for anything public visitors reach. Self-signed certificates are legitimate for internal services where you control the clients and can distribute the root yourself; on the public internet they produce the same browser warning as any other invalid certificate.
Does a valid certificate mean my site is secure?
No — it means something narrower and still important: traffic between the visitor and the server presenting this certificate is encrypted, and the certificate for this hostname was issued by a trusted authority. It says nothing about the application behind it. Validation is a floor, not a ceiling; a phishing site can have a perfectly valid certificate.
Is this SSL validation free?
Yes — validate as many hostnames as you like, no account needed; scripted use is rate limited to keep the tool responsive. The paid product is the ongoing version of the same thing: Upcheck re-validates the certificate on every hostname you monitor every 12 hours and alerts your team when one expires, breaks, or changes when nobody deployed.
One check tells you now. Monitoring tells you before it matters again.
Add your hostnames to Upcheck and get alerted by email, Slack, Discord, Teams, or webhook — well before the next certificate lapses.