SSL Certificate Checker.

Enter your domain above and the result shows the expiry date, the days left and a renew-by date. You can also open the certificate details from the padlock in your browser, or run openssl s_client -connect example.com:443 -servername example.com and read the notAfter date. Let's Encrypt recommends renewing when a third of a certificate's lifetime is left, which is how the renew-by date is set.

The usual cause is a missing intermediate certificate. The server sends only its own certificate, so a client that cannot fetch the intermediate by itself cannot build a path to a trusted root. Some browsers fetch it quietly; tools like curl and most mail servers do not. This checker does not fetch it either, so it reports the gap. Serve the full chain: your certificate followed by the intermediate.

It means the name you visited is not in the certificate's Subject Alternative Names. Clients ignore the Common Name for this (RFC 9525). A wildcard such as *.example.com covers www.example.com but not example.com itself and not a.b.example.com, because a wildcard matches exactly one label. Reissue the certificate with every name you serve, or add the missing name.

A publicly trusted certificate issued on or after 15 March 2026 can be valid for at most 200 days. The limit drops to 100 days on 15 March 2027 and 47 days on 15 March 2029, under the CA/Browser Forum Baseline Requirements. Certificates issued before March 2026 could last up to 398 days, so you may still see longer ones until they expire.

No. Since March 2024 public CAs must publish revocation lists, but OCSP is optional, and Let's Encrypt turned off its OCSP service in August 2025. A certificate without an OCSP address has nothing to staple. If yours carries one, stapling saves clients a lookup, and the checker shows whether your server staples and what the CA says about the certificate.

STARTTLS is the SMTP command that upgrades a plain connection on port 25 or 587 to an encrypted one (RFC 3207). Choose Mail Domain, enter your domain, and the checker connects to each MX host, reads its banner and capabilities, sends STARTTLS, completes the handshake and checks the certificate against the MX name. Google asks every sender to use a TLS connection for email.

MTA-STS lets a domain tell sending servers that its MX hosts support TLS with valid certificates and, in enforce mode, to refuse delivery otherwise (RFC 8461). It is a TXT record at _mta-sts plus a policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt. It protects mail you receive, not mail you send. The checker confirms the policy lists every MX you publish.

Yes. Choose Tracking Domain and enter the hostname your tracked links use. The checker shows where its CNAME points, whether the certificate covers that exact hostname, and whether http:// links redirect to https://. A tracking hostname without a valid certificate for its own name makes every https:// link in your email open with a browser warning.

We keep the hostname you checked, the mode, the result of each check and the certificate's fingerprint, issuer and expiry for 90 days, with your IP address and browser, to prevent abuse. We do not keep the certificates themselves or the mail server conversation. Checking a mail domain opens an SMTP connection to its MX hosts and ends it after STARTTLS, without sending any mail.