Check
SSL checker
Enter a domain to check its certificate, chain, TLS versions and security headers in a few seconds.
The SSL checker tests the HTTPS setup of any public host: type a domain such as example.com (or paste a URL) and press Check SSL. Our server connects like a browser would, reads the certificate chain the server sends and lists every problem it finds, with a grade from A+ to F.
How to use it
- Enter a domain, host name or URL. The scheme and path are removed automatically, so
https://www.example.com/logincheckswww.example.com. - Change the port if the service is not on 443, or write
host:port. - Press Check SSL and read the result page. Each finding links to an explanation.
From a terminal the same check is one command:
curl ssl.sh/example.com
What the check covers
The result lists what a client experiences during the TLS handshake:
- Certificate: subject, SANs, issuer, validity dates and days left, key type and signature algorithm.
- Chain: the certificates in the order the server sends them, whether the chain is complete, and whether it ends at a root trusted by the major root programs.
- Hostname: whether the name you entered is covered by the certificate's SANs. Browsers ignore the Common Name.
- Protocols: which of TLS 1.0, 1.1, 1.2 and 1.3 the server accepts, plus the negotiated cipher suite and key exchange group.
- Headers and DNS: the HSTS header, CAA records and whether the server staples an OCSP response.
Reading the result
Start with the findings marked in red: an expired certificate, a hostname mismatch or an untrusted chain breaks the site for every visitor. Then fix the warnings: incomplete chains break many non-browser clients, and TLS 1.0/1.1 were deprecated by RFC 8996 in 2021.
If the certificate expires soon, renew it and plan automation: the maximum certificate lifetime dropped from 398 to 200 days on 15 March 2026 and falls to 47 days by 2029. The validity calculator shows the limit for any issue date.
Tips
- Check every name you serve, including
wwwand the bare domain; they often have different certificates. - After changing a certificate, reload the web server. A check that still shows the old certificate means the server has not picked up the new file.
- For many hosts at once use the bulk SSL checker.
FAQ
What does the grade mean?
Grades run from A+ (no problems, modern TLS and HSTS) down to F (a failure that breaks the site, such as an expired certificate). T means the certificate does not chain to a publicly trusted root. The findings list explains every point that lowered the grade.
Why does my site work in my browser but fail here?
Usually a missing intermediate certificate. Desktop browsers can fetch or cache missing intermediates; many other clients (curl, Java, Android apps) cannot. The checker shows the chain exactly as your server sends it, so fix the server to send the full chain.
Can I check a port other than 443?
Yes. Enter the port next to the host name, or write host:port in the box. For mail and other protocols that start in plain text, use the STARTTLS checker.
What information does the check use?
Only public information: the certificate chain and HTTP headers any visitor receives, and public DNS records such as CAA. No login or agent on your server is needed.