SSL certificate checker

Enter a domain and we will connect to it over HTTPS to show you its certificate: whether it is trusted, when it expires, who issued it, which domains it covers and the full certificate chain.

SSL/TLS certificate of a domain

For example: vermiip.es or https://www.example.com. Port 443 is checked.

What is an SSL certificate?

An SSL/TLS certificate is a digital document that binds a domain to a cryptographic key. It lets the browser encrypt the connection (HTTPS, the padlock in the address bar) and check that it is talking to the genuine website and not an impostor. It is signed by a certificate authority (CA) trusted by browsers, such as Let's Encrypt, DigiCert or Sectigo.

Most common errors

Expired certificate: certificates last a few months at most (90 days for Let's Encrypt) and must be renewed automatically. Domain not included: the certificate does not cover the name being visited, for example when it covers example.com but not www.example.com. Incomplete chain: the server does not send the intermediate certificate; some browsers fetch it themselves, but many clients (apps, curl, other servers) fail.

SAN, wildcards and the chain

The SAN (Subject Alternative Name) extension lists every domain the certificate covers. A wildcard like *.example.com is valid for one level of subdomain (www.example.com, blog.example.com), but not for example.com or a.b.example.com. The chain goes from the domain certificate to the CA's intermediates, whose root is already installed in the operating system or browser.