SSL certificate & TLS checker
An expired or mismatched certificate takes a site offline for every visitor; an obsolete protocol fails PCI DSS audits. Check the certificate and the TLS versions your server accepts in a few seconds.
Reads only public data. Results are not stored.
What this tool checks
We open a few TLS handshakes on port 443, exactly like a browser, and inspect the certificate the server presents and the protocol versions it accepts.
Questions
How early should I renew a certificate?
Automate renewal (certbot or your host's auto-renew) so it happens about 30 days before expiry. We warn from 30 days and raise the severity in the last two weeks.
Why is TLS 1.0 or 1.1 a problem?
Both are deprecated (RFC 8996), have known weaknesses and are forbidden by PCI DSS. Modern browsers no longer use them, so disabling them costs nothing.
My certificate is valid, why is it untrusted?
Usually the server sends only its own certificate without the intermediate ones. Configure the full chain (fullchain.pem with Let's Encrypt).