# SSL Checker: Test Any HTTPS Certificate and TLS Setup

> Free SSL checker: test a domain's certificate chain, expiry, hostname, TLS 1.0–1.3 support, HSTS, CAA and OCSP stapling, with a grade.

Source: https://ssl.sh/tools/ssl-checker/
Last updated: 2026-11-10

Enter a domain to check its certificate, chain, TLS versions and security headers in a few seconds.

The SSL checker tests the HTTPS setup of any public host: type a domain such as `example.com` (or paste a URL) and press **Check SSL**. Our server connects like a browser would, reads the [certificate chain](https://ssl.sh/glossary/certificate-chain/) the server sends and lists every problem it finds, with a grade from A+ to F.

## How to use it

1. Enter a domain, host name or URL. The scheme and path are removed automatically, so `https://www.example.com/login` checks `www.example.com`.
2. Change the port if the service is not on 443, or write `host:port`.
3. Press **Check SSL** and read the result page. Each finding links to an explanation.

From a terminal the same check is one command:

```bash
curl ssl.sh/example.com
```

## What the check covers

The result lists what a client experiences during the [TLS handshake](https://ssl.sh/glossary/tls-handshake/):

- **Certificate**: subject, [SANs](https://ssl.sh/glossary/san/), issuer, validity dates and days left, key type and signature algorithm.
- **Chain**: the certificates in the order the server sends them, whether the chain is complete, and whether it ends at a root trusted by the major root programs.
- **Hostname**: whether the name you entered is covered by the certificate's SANs. Browsers ignore the Common Name.
- **Protocols**: which of TLS 1.0, 1.1, 1.2 and 1.3 the server accepts, plus the negotiated cipher suite and key exchange group.
- **Headers and DNS**: the HSTS header, CAA records and whether the server staples an OCSP response.

## Reading the result

Start with the findings marked in red: an expired certificate, a hostname mismatch or an untrusted chain breaks the site for every visitor. Then fix the warnings: [incomplete chains](https://ssl.sh/errors/missing-intermediate-certificate/) break many non-browser clients, and TLS 1.0/1.1 were deprecated by RFC 8996 in 2021.

If the certificate expires soon, renew it and plan automation: the maximum certificate lifetime dropped from 398 to 200 days on 15 March 2026 and falls to 47 days by 2029. The [validity calculator](https://ssl.sh/tools/validity-calculator/) shows the limit for any issue date.

## Tips

- Check every name you serve, including `www` and the bare domain; they often have different certificates.
- After changing a certificate, reload the web server. A check that still shows the old certificate means the server has not picked up the new file.
- For many hosts at once use the [bulk SSL checker](https://ssl.sh/tools/bulk-ssl-checker/).


## FAQ

**What does the grade mean?**

Grades run from A+ (no problems, modern TLS and HSTS) down to F (a failure that breaks the site, such as an expired certificate). T means the certificate does not chain to a publicly trusted root. The findings list explains every point that lowered the grade.

**Why does my site work in my browser but fail here?**

Usually a missing intermediate certificate. Desktop browsers can fetch or cache missing intermediates; many other clients (curl, Java, Android apps) cannot. The checker shows the chain exactly as your server sends it, so fix the server to send the full chain.

**Can I check a port other than 443?**

Yes. Enter the port next to the host name, or write host:port in the box. For mail and other protocols that start in plain text, use the [STARTTLS checker](tool:starttls-checker).

**What information does the check use?**

Only public information: the certificate chain and HTTP headers any visitor receives, and public DNS records such as CAA. No login or agent on your server is needed.