SSL Checker
This free SSL checker connects to a website the way a browser does and shows its certificate: who issued it, when it expires, which names it covers, whether the chain is complete and which TLS versions the server accepts.
What the SSL checker looks at
We open a secure connection to the site from our server in Germany, the same way a browser does, and read the certificate it sends. We check the dates, the names it covers and whether it chains up to a certificate authority that browsers trust.
Then we try TLS 1.0, 1.1, 1.2 and 1.3 separately, so you can see which versions the server still accepts. The old ones should be switched off.
The most common SSL problems
An expired certificate is the classic one: browsers show a full-page warning and most visitors leave. Free Let's Encrypt certificates last 90 days, so automatic renewal matters.
The sneakier one is a missing intermediate certificate. Desktop browsers often fill the gap themselves, so the site looks fine to you, while phones, apps and other servers reject it. The fix is to install the full chain, often a file called fullchain.pem.
Checking mail and other ports
Mail servers use certificates too. Pick port 465 for SMTPS, 993 for IMAPS or 995 for POP3S to see the certificate your email app sees.
To check encryption on port 25, where mail servers switch to TLS with STARTTLS, use our SMTP test instead.
Frequently asked questions
How often can I run a check?
Each visitor can run 2 checks a minute and 10 an hour, which keeps the checker fast and stops it being misused. When a site answered, we keep the result for 5 minutes, and repeat views of it don't count.
Why does my site work in my browser but fail here?
Usually it's a missing intermediate certificate. Your browser may already have it from another site, so it fills the gap; a fresh client can't. Install the full certificate chain and check again.
Is a free SSL certificate as secure as a paid one?
The encryption is the same. Paid certificates add things like organisation validation, a warranty and support, which some businesses want for trust or compliance.
Which TLS versions should my server accept?
TLS 1.2 and TLS 1.3. TLS 1.0 and 1.1 are outdated and modern browsers no longer use them, so switching them off costs you nothing.
Do you store the results?
When a site answered, we keep the result for 5 minutes so repeat checks are instant, and our server logs which site was checked for 14 days so we can deal with abuse. We don't store your IP address, only a scrambled form of it.