Free SSL checker: expiry is only the failure everyone remembers

Certificate failures are unusually costly because they are binary and total. A visitor does not see a degraded site — they see a full-page browser warning telling them not to proceed, and most do not.

Expiry: the famous one

Still the most common cause of an SSL outage, and entirely preventable. Automate renewal, and monitor that the automation is working — a renewal cron that has been failing quietly for two months is the actual failure mode, not the expiry itself.

The chain: the confusing one

Your certificate is signed by an intermediate, which is signed by a root. Your server must serve the full chain. If it omits the intermediate, some clients complete it from cache and succeed while others fail outright.

The result is the report that wastes the most time: 'it works for me'. It genuinely does work for the person saying it, and the server is genuinely misconfigured.

Hostname coverage

A certificate for example.com does not automatically cover www.example.com. Both need to be in the certificate if both resolve — and both usually do, because somebody will link to the one you did not plan for.

Protocol and cipher configuration

TLS 1.0 and 1.1 are deprecated and should be disabled. This rarely produces a visible failure, which is exactly why it persists — the configuration works, it is simply weaker than it should be, and nothing complains.

After the certificate is right

Redirect all HTTP to HTTPS, then add Strict-Transport-Security so browsers stop attempting HTTP entirely. The redirect closes the door; the header stops anyone knocking.

What free means here

Our SSL checker is free, with no account needed for your first scan. It reports expiry, hostname coverage, chain completeness and protocol configuration — the four things that decide whether every visitor reaches you or only most of them.