SSL/TLS Certificate Checker: Verify & Analyze Online
SSL certificate checker online: verify expiry, issuer, key strength, and chain validity from certificate files or pasted PEM, with expiration alerts.
Updated 2026-08-26
Related Tools
HTTP Headers Viewer: Analyze & Audit Response Headers
DNS Lookup: All 16 Record Types (A, AAAA, MX, SRV)
RSA/ECDSA Key Generator: PEM Keys for SSH, TLS & JWT
IP Address Lookup: Online Geolocation, ISP & ASN Info
Ping & Traceroute: Test Network Latency & Server Uptime
Port Scanner Online: Check Open Ports & Common Services
Features
- Open .pem, .crt, or .cer certificate files for instant analysis
- Paste PEM certificate, openssl x509 text output, or openssl s_client output
- Auto-detects certificate format: PEM, openssl text, or openssl s_client output
- Displays certificate details: subject, issuer, validity dates, serial number, and SANs
- Shows key type (RSA/ECDSA) and key size with security assessment
- Security checks: expired, self-signed, weak algorithm, short validity period
- Visual status badges for quick pass/fail overview
- Expiry date countdown: shows exactly how many days remaining until the certificate expires, with color-coded warnings for certificates expiring within 30 days (yellow) or 7 days (red)
- Certificate chain analysis: detects whether the certificate chain is complete or if intermediate certificates are missing, which can cause browser trust warnings on some devices
- Signature algorithm strength check: identifies weak signature algorithms like SHA-1 that have known collision vulnerabilities and should be replaced immediately
- Extensive error handling: provides clear error messages for malformed PEM data, unsupported formats, or corrupted certificate files, with suggestions for next steps
- Works offline after first load
How to Use
- 1Click the Open tab and select a .pem/.crt/.cer certificate file to analyze.
- 2Or click the Paste tab to paste openssl output or PEM certificate data.
- 3Review the Certificate Details section for subject, issuer, validity, and SAN information.
- 4Check the Security Assessment panel for any warnings about expired, self-signed, or weak certificates.
- 5Use openssl s_client -connect example.com:443 in a terminal to get certificate data.
- 6Use openssl x509 -text -noout < cert.pem to get a detailed text representation.
- 7Check the validity countdown in the details panel: certificates expiring within 30 days should be renewed immediately to avoid service disruption
- 8Review the certificate chain section to see if intermediate certificates are included: missing intermediates can cause trust errors on mobile devices and older browsers
Frequently Asked Questions
What is an SSL certificate?
An SSL certificate is a digital file that binds a public key to a domain name, letting browsers establish encrypted HTTPS connections. Certificates are issued by certificate authorities (CAs) and contain the domain, issuer, validity dates, and public key: typically valid for 90 days to 1 year. 'SSL certificate' is the traditional name for the X.509 files TLS uses today; this checker validates them from local files or pasted certificate output. (See: RFC 5280)
What certificate file formats are supported?
PEM format (.pem, .crt, .cer) is the most common: it contains -----BEGIN/END CERTIFICATE----- markers. DER format (.der) is also supported. You can also paste openssl x509 -text output for structured analysis.
What does 'self-signed' mean and is it a problem?
A self-signed certificate is one where the issuer and subject are the same entity: it was not signed by a trusted Certificate Authority. Self-signed certificates are fine for development and internal use, but browsers will show security warnings for public websites because there is no chain of trust.
Why does my SSL TLS certificate checker flag my certificate as insecure?
The checker flags a certificate when any check fails: key size below 2048 bits (1024-bit keys are considered broken), an SHA-1 signature, a certificate that is expired or not yet valid, a missing intermediate in the chain, or a self-signed certificate on a public site. Each of those is a real risk, not a false alarm. Fix the failing check rather than ignoring it. Note that a free certificate from Let's Encrypt passes all checks exactly like a paid one; price is irrelevant to security.
Can I check certificates that are not publicly accessible?
Yes. Open certificate files from servers you manage, or paste openssl output. The tool works entirely offline with opened or pasted data. No internet connection required for analysis.
What does the validity period tell me?
The validity period shows the date range during which the certificate is considered valid. Most trusted CAs now issue certificates valid for 90 days to 1 year. Certificates with very long validity periods (10+ years) may be using outdated security practices.
What is a SAN (Subject Alternative Name)?
SANs are additional domain names or IP addresses that the certificate protects. A single certificate can secure multiple domains (e.g., example.com, www.example.com, api.example.com). Modern certificates use SANs instead of the older Common Name field for domain matching.
What is the difference between SSL and TLS?
SSL (Secure Sockets Layer) was the original protocol, released by Netscape in the mid-1990s; TLS (Transport Layer Security) is its successor, standardized in 1999. SSL 2.0/3.0 and the early TLS 1.0/1.1 versions are all deprecated and blocked by modern browsers. Current connections use TLS 1.2 or 1.3. 'SSL certificate' is really just the traditional marketing name for an X.509 certificate, the same file used by TLS. So when someone asks for an 'SSL certificate', they mean a TLS certificate, and the checker here validates it the same way. (See: RFC 5280)
Why do I get 'certificate validation failed' errors?
The five most common causes: 1) the certificate is expired: check the validity dates here; 2) hostname mismatch: the certificate covers example.com but the site is served from www.example.com, or vice versa (check the SAN list); 3) missing intermediate certificates in the chain: common on mobile devices; 4) the client's clock is wrong, so a valid certificate looks expired; 5) a self-signed or SHA-1-signed certificate on a public site. This tool flags every one of these (expiry, SANs, chain completeness, self-signed status, signature algorithm), so run your certificate through it and fix whichever check fails.
What is a certificate chain and why does it matter?
A certificate chain (or certification path) consists of the server certificate, one or more intermediate certificates, and a root certificate. The chain establishes trust by linking your server certificate to a trusted root CA (Certificate Authority) through intermediate CAs. If intermediate certificates are missing from the chain, some devices (especially mobile phones and older operating systems) may not be able to validate the chain, causing SSL/TLS errors. The tool checks if the chain is complete and flags missing intermediates.
Why does my SSL TLS certificate validation fail on some devices but not others?
Usually a chain problem: the server omits the intermediate certificate, which desktop browsers can often fetch automatically but older phones, IoT devices, and strict clients cannot; so validation fails only where the missing piece cannot be downloaded. Another common cause is the client's trust store: devices with outdated stores may distrust newer roots or reject SHA-1-signed certificates. Fix the server chain first (serve the full chain file), then re-test from several devices and networks.
How do I renew an expiring SSL certificate?
When the tool shows less than 30 days until expiry, generate a new Certificate Signing Request (CSR) on your server, submit it to your CA (Certificate Authority), complete the domain validation process (usually via email, DNS record, or HTTP file), download the issued certificate along with any intermediate certificates, install all files on your server, and restart your web server. Verify the installation by re-testing with this tool. Most modern CAs auto-renew via the ACME protocol (e.g., Let's Encrypt certbot).
How do I get the certificate data for a domain to paste into the checker?
From a terminal: openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -outform PEM. Or use openssl x509 -text -noout < cert.pem if you have the file locally. In a browser, open DevTools → Security → View certificate, then export or copy the PEM block. Any of these produce the -----BEGIN CERTIFICATE----- text this tool accepts.