Summary: What the SSL Certificate Checker Tells You
An SSL certificate checker shows whether a website's HTTPS works and when its certificate runs out. Type a domain such as example.com, click Check SSL, and usually within a few seconds (a slow site or log service can stretch it past 20 seconds) you see the newest certificate's issuer, start and end dates, days left and the names it covers, next to a live HTTPS test that says whether a secure connection succeeds today.
This tool is not client-side. When you click Check SSL, the domain you typed is sent to ZipConvert's server (nothing is sent on page load or while you type). The server makes one HEAD request to https://your-domain/ from Cloudflare's network, looks up the name with Cloudflare's DNS resolver, and asks Cert Spotter's public Certificate Transparency API which certificates are logged for it. Checks are limited to 15 per minute per IP address.
Table of Use: Questions the Checker Answers
| Question | Where to look | How to read it |
|---|---|---|
| When does the certificate expire? | Valid until, plus the days-left box | Valid: 30 or more days. Renew soon: 7 to 29. Critical: under 7. An expired certificate is not listed; if the server still sends it, the probe shows HTTPS failed. |
| Does HTTPS work right now? | The status box and HTTP status | HTTPS working means the TLS handshake was accepted, even if the page itself returned a 301 or 404. |
| Who issued the certificate? | Issuer (Certificate Authority) panel | The CA name from the log entry, with a Copy button. |
| Does it cover www and subdomains? | Names on Certificate (SANs) | Every name on the newest certificate. A wildcard such as *.example.com covers one subdomain level, not example.com itself. |
| Did my renewal go through? | Unexpired Certificates (CT log) | Up to eight certificates, latest expiry first. A new row with a later date means a new certificate was issued. |
| Why is my browser warning me? | The red message under the status box | HTTPS failed with status 526 (certificate rejected) or 525 (handshake failed). |
| Result shown | Meaning |
|---|---|
| HTTPS working | The probe connected and a certificate for the name is in the logs. |
| HTTPS failed | The connection failed, or the probe got status 525 or 526. A server that still sends an expired certificate shows up this way. |
| Site unreachable | The probe got status 520 to 524 or 530: the site's server could not be reached or its name could not be resolved, so HTTPS could not be confirmed. |
| HTTPS working, no logged certificate found | The connection succeeded but no unexpired, unrevoked certificate covering the name is in the log feed. |
| HTTPS working, certificate log unavailable | The connection succeeded but Cert Spotter could not be read; try again later. |
Features of the SSL Certificate Checker
- Two evidence sources, kept apart. The certificate panels come from public Certificate Transparency logs; the live HTTPS probe is a separate connection test.
- Expiry at a glance. Whole days left, labeled Valid, Renew soon or Critical.
- Several certificates, one view. Up to eight unexpired certificates for the name, each with issuer, validity window and a Revoked or Active tag. A notice flags when the log holds more than were read.
- Wildcards matched. A subdomain served by a wildcard certificate is found, not reported as having none.
- DNS check. It reports whether the name resolves to an A or AAAA record.
- Copy buttons for the issuer and for the full list of covered names.
Not shown: TLS version, cipher suite, key size, fingerprints, serial numbers or the intermediate certificates the server sends, because the platform running the probe does not expose them. The probe always tests port 443 and does not follow redirects.
How to Use the SSL Certificate Checker
- Type a domain in the box (a pasted URL is reduced to its hostname), or click one of the Try examples: google.com, github.com, cloudflare.com or wikipedia.org.
- Click Check SSL or press Enter and wait; a check usually takes a few seconds.
- Read the status box first: HTTPS working, HTTPS failed or Site unreachable, with the HTTP status.
- Check Valid from, Valid until and the days-left box.
- Open Names on Certificate (SANs) to confirm your www and subdomain names are covered, and use Copy All to save the list.
- If a red message appears, read it with the HTTP status shown, then fix the server and run the check again.
Check example.com and www.example.com separately; they are different names. To compare against the server itself, open the HTTP Header Viewer to see its redirect chain and HSTS header, the DNS Lookup tool for the records behind the name, and the Port Scanner reference for what belongs on port 443.
Who Can Use the SSL Certificate Checker
- Site owners who want to see how many days are left before a certificate lapses.
- Developers and sysadmins confirming a renewal reached the logs and the right names are covered.
- Agencies and support teams diagnosing a client's “not secure” warning without access to the server.
- Buyers and researchers checking who issued a site's certificate and which names it covers.
Pair it with the WHOIS Lookup for the domain's own registration expiry, and paste an address from the DNS Lookup into the IP Address Lookup to see the network that hosts it. Put the end date into the Countdown Timer to count down to it, work out the days between issue and expiry with the Date Difference Calculator, or turn the expiry date into a Unix timestamp for a monitoring script with the Timestamp Converter. Once HTTPS is healthy, the .htaccess Generator can write the rule that forces visitors onto it.
FAQs: SSL Certificate Checker Questions
How do I check when an SSL certificate expires?
Type the domain, click Check SSL, then read Valid until and the days-left box. Valid means 30 or more days remain, Renew soon means 7 to 29, and Critical means fewer than 7. The date belongs to the newest unexpired certificate in the public logs; when several are active, the page also states the earliest expiry. Cert Spotter lists only unexpired certificates, so an expired one is not shown; if the server still sends it, the probe reports HTTPS failed (526).
Why does my browser show a different expiry date than this checker?
The checker reads certificates that were issued for the name, not the one your server is sending. If you renewed but the web server or a load balancer was never reloaded, it keeps presenting the older certificate. The padlock menu in your browser shows the exact certificate in use, so compare it with the earliest-expiry note on this page.
What does HTTP status 526 or 525 mean in an SSL check?
Both numbers come from the HTTPS probe. 526 means the connection reached the site but the certificate failed validation: it may be expired, self-signed, issued for another name, or missing an intermediate certificate. 525 means the TLS handshake itself failed. The probe cannot say which cause applies, so compare the certificate names and dates shown beside it. Statuses 520 to 524 and 530 are different: the site's server could not be reached or its name could not be resolved, so the result reads Site unreachable.
Is it safe to enter my domain, and what data does the checker send?
The check is not client-side. Only the domain you typed is sent to ZipConvert's server when you click Check SSL, never on page load. The server then sends that name to Cloudflare's DNS resolver and to Cert Spotter's public API, and makes one HTTPS request to the site. It keeps only a per-minute request counter tied to your IP address, which expires after about two minutes.
What is the difference between SSL and TLS?
TLS (Transport Layer Security) is the newer protocol that replaced SSL (Secure Sockets Layer). SSL is deprecated and no modern browser negotiates it, but the name stuck, so certificates for HTTPS are still sold and searched for as SSL certificates. A certificate checked here works the same way for any current TLS version.
Can I check a self-signed, internal or localhost certificate?
No. Self-signed and private-CA certificates are never published to Certificate Transparency logs, so the certificate panels stay empty, and the probe fails for them because they are not publicly trusted. The tool only works for public domain names on port 443; localhost, private-network addresses and IPv6 literals are refused. For internal hosts use openssl s_client on your own machine.
How long can an SSL certificate be valid in 2026?
As of October 2026, publicly trusted certificates issued on or after 15 March 2026 may be valid for at most 200 days, under CA/Browser Forum ballot SC-081v3. The limit falls to 100 days for certificates issued from 15 March 2027 and 47 days from 15 March 2029. Older certificates could last up to 398 days. Automated renewal is now practically required.