Skip to content
WebsiteValidator

AI & security

SSL Certificate Checker

A real handshake: certificate, expiry, protocol and cipher

This opens a real TLS connection to your origin and reads what came back: the negotiated protocol and cipher suite, and the leaf certificate's issuer, validity window, days remaining and subject alternative names.

Quick runs this page's high-signal checks in about 3 seconds, no browser. Full adds Core Web Vitals, the accessibility engines and a screenshot, and takes about a minute.

Try:
  • Free, no signupNo account, no card
  • No AI in the score986 deterministic rules
  • Nothing publishedYour scans stay yours
  • Answers in secondsQuick scan, no browser

Two failures it catches that nothing else will. A certificate that does not cover the hostname visitors actually use - the www form when only the apex was issued - produces the same full-page browser warning as no certificate at all. And a renewal that ran successfully but was never reloaded by the web server leaves an expired certificate serving happily until it takes the site down.

The handshake deliberately does not abort on an untrusted chain. Refusing to continue would mean returning nothing for exactly the sites worth reporting on - expired, self-signed, missing an intermediate. The connection completes, the reason is recorded, and a rule decides what it means.

Why this matters

Someone says the site is "not secure". It loads for me.

Certificates renew themselves now, so nobody watches them, and the TLS settings are usually whatever the host configured years ago. When something slips, the browser deals with it before your server hears anything: a full-page warning, or a padlock replaced by the words 'Not secure'. Your logs stay clean, your analytics just dip, and the alarm is a person taking the trouble to tell you.

What it costs you when this is wrong

  • With HSTS set, there is no way through

    HSTS tells a browser never to touch your domain over plain HTTP, and RFC 6797 requires it to treat a bad certificate as fatal - no 'proceed anyway' link. So the day the certificate breaks, your regulars and your own staff hit a dead end while a browser that has never seen the header may still be offered a way in. The first reports contradict each other, which is what makes them hard to believe.

  • One http:// script and the feature is gone

    On an HTTPS page a browser blocks insecure scripts, stylesheets and frames outright, and only flags insecure images and media. A single http:// URL left in a template can therefore remove the cart, the slider or the booking widget while the page still looks broadly right. The only notice is a console message no visitor will ever send you.

  • TLS 1.0 fails the card-payment questionnaire

    RFC 8996 deprecated TLS 1.0 and 1.1 in 2021, and PCI DSS has prohibited them for card handling since 2018. A load balancer still terminating on an old version costs you the security questionnaire and the acquirer's scan, on top of browsers that warn or refuse. You find out when a partner forwards the failed report, not when a customer complains.

Why run it here

  • No verdict without a handshake

    Every certificate rule declares that it needs a live connection, and that connection is given eight seconds. If the origin is plain HTTP, or the handshake times out, those rules report 'not checked' with the reason rather than a pass. An unearned tick on transport security is worse than an obvious gap.

  • It reads the page, not just the port

    A certificate test inspects the host on port 443. The same run also reads your delivered HTML for http:// scripts, stylesheets, frames, images, audio and video, and checks the Strict-Transport-Security header for presence, a max-age of at least a year, and whether it covers subdomains.

  • Part of one audit, and never listed publicly

    This does not grade the chain or enumerate every protocol and suite your server would accept - Qualys SSL Labs' free server test goes deeper on the certificate, and it is better to say so. What you get here is what your visitors' connection actually negotiated, inside a single pass of all 986 rules, scoped to your own browser session: a report becomes public only if the domain's owner asks for one.

This check runs on its own here, and as part of the full audit alongside the other 985 rules. Either way the findings carry their evidence and their citation, and the report is never published or kept.

How to fix SSL certificate problems

Certificate problems are binary in effect: a visitor either sees your site or sees a full-page browser warning telling them not to.

  1. Renew before expiry and automate it. Expiry is the single most common cause of an outage that nobody was watching for.

  2. Serve the full chain, including intermediate certificates. A missing intermediate works in some browsers and fails in others, which makes it hard to diagnose.

  3. Cover every hostname you actually serve, including the www and non-www forms.

  4. Disable TLS 1.0 and 1.1 and any weak cipher suites still enabled.

  5. Redirect all HTTP traffic to HTTPS, then add Strict-Transport-Security so the browser stops trying HTTP at all.

What happens when you run it

  1. Enter your address

    Just the domain is enough — example.com, with or without the https. No account, no card, no crawl of your whole site.

  2. We render it like a visitor

    Your page opens in a real browser and JavaScript runs to completion, so what gets audited is the page a person actually sees — not the raw HTML your server sent. A screenshot comes back with the report as evidence of exactly what we measured.

  3. You get findings you can act on

    Up to 986 checks run against that rendered page. Each finding names the rule, quotes the evidence found on your page, cites the public specification behind it, and says what to change. Nothing is a judgement call — run it twice on an unchanged page and the score is identical.

What runs this check

  • Live TLS handshake

Named because provenance is the product. Every finding in your report says which of these produced it, so you can check the reasoning rather than take a score on faith.

What this checks

10 rules · 10 affect your score

  • Site is served over HTTPS

    Critical

    The page must be served over HTTPS, not plain HTTP.

    SEC_HTTPS scored

  • Certificate chain validates against the public trust store

    Critical

    Completes a real TLS handshake and checks whether the presented certificate chain validates against the system trust store. A chain that does not validate produces a full-page browser interstitial - the single most damaging thing that can happen to a page, and one no response-header check can detect.

    SEC_TLS_CERT_TRUSTED scored

  • Certificate covers the hostname being served

    Critical

    Checks the scanned hostname against the certificate's subject alternative names, including wildcard entries. A certificate that does not cover the hostname triggers the same interstitial as an expired one, and it is easy to miss when the apex and www forms are configured separately.

    SEC_TLS_HOSTNAME_COVERED scored

  • Certificate is not close to expiry

    High

    Reads the leaf certificate's expiry date from the handshake. An expired certificate blocks the entire site behind an interstitial, and because renewal is usually automated, the failure mode is silent right up until it is total.

    SEC_TLS_CERT_NOT_EXPIRING scored

  • Connection negotiates TLS 1.2 or better

    High

    Reports the protocol version actually negotiated. RFC 8996 deprecated TLS 1.0 and 1.1 in 2021; browsers now warn or refuse outright, and PCI DSS has prohibited them for card handling since 2018.

    SEC_TLS_PROTOCOL_MODERN scored

  • No mixed (insecure) content on an HTTPS page

    High

    Subresources loaded over http:// from an https:// page are either blocked outright (scripts, stylesheets, frames) or flagged as insecure (images, media), breaking both the padlock and, often, the page.

    SEC_MIXED_CONTENT scored

  • Negotiated cipher suite has no known weaknesses

    High

    Reports the cipher suite the server actually chose and checks it against constructions with published weaknesses - RC4, 3DES, single DES, export-grade suites, MD5 integrity and anonymous key exchange.

    SEC_TLS_STRONG_CIPHER scored

  • Strict-Transport-Security header present

    Medium

    HSTS instructs browsers to always use HTTPS for this domain, preventing downgrade/SSL-stripping attacks.

    SEC_HSTS_HEADER scored

  • HSTS max-age is at least one year

    Medium

    A short HSTS max-age leaves a window in which a downgrade attack still works, and preload list submission requires 31536000 or more.

    SEC_HSTS_LONG_MAXAGE scored

  • HSTS covers subdomains

    Low

    Without includeSubDomains, a single insecure subdomain can be used to set cookies for the parent domain.

    SEC_HSTS_SUBDOMAINS scored

Questions

How many days before expiry should I worry?
Anything under three weeks is flagged. Most certificates renew automatically, so the interesting case is not the countdown itself - it is a countdown that is not moving, which means the automation has silently stopped.
Does it check the whole chain?
It reports whether the presented chain validates against the system trust store and why it did not, which is what catches a missing intermediate - the single most common certificate misconfiguration.

Also checks

This page answers these searches too — they are the same job, so they share one page rather than being split across near-identical ones:

  • tls checker
  • ssl certificate expiry
  • https checker
  • certificate validity check

Other checkers

Run the ssl certificate checker now

No signup, no credit card. Quick answers in seconds; a full audit takes about a minute.

Run a free scan

No signup. No credit card. Nothing stored but the result.