SSL Checker

What is an SSL checker and what does this one test?

An SSL checker reads the certificate and connection settings of a domain from the outside and turns them into a report. The padlock in the browser only tells you that the current connection is encrypted. However, it does not tell you when the certificate ends or whether the chain is complete. This tool connects to port 443 of your domain from our server and gives you one report with:

• Days left and dates: start, expiry and how much of the lifetime has passed.
• Hostname match: is the name you checked on the SAN list?
• Chain: server certificate, intermediates and the trusted root.
• Connection: support for TLS 1.0, 1.1, 1.2 and 1.3 plus the negotiated cipher.
• Redirect and HSTS: whether http:// goes to HTTPS and which HSTS header the site sends.

I run this check on launch day for every new site and again after any server change. In web design projects, installing the certificate is the easy part; the real job is making sure renewal has not quietly broken months later. Also, the tool changes nothing on your site and does not store the domain or the report.

Why are SSL certificate lifetimes getting shorter?

Certificate lifetimes have been shrinking for years, and the pace is picking up. The CA/Browser Forum, where browser makers and certificate authorities set the rules, passed ballot SC-081v3 in 2025. It cuts the maximum lifetime in steps:

• Until March 15, 2026: 398 days.
• From March 15, 2026: 200 days.
• A year later, from March 15, 2027: 100 days.
• The last step, March 15, 2029: 47 days.

Let's Encrypt moves even faster. Its default certificates last 90 days today, drop to 64 days on February 10, 2027 and to 45 days on February 16, 2028. In addition, Let's Encrypt stopped sending expiry reminder emails on June 4, 2025. In other words, nobody warns you anymore before a certificate runs out.

Renewing by hand is therefore turning into a losing game. You need an ACME client such as Certbot or the automatic renewal in your hosting panel. Even then the work is not done, because a DNS change, a closed port 80 or a full disk can stop renewal without a sound. That is why checking the days left on a schedule is the cheapest insurance you can buy.

What does an untrusted chain in an SSL checker mean?

A certificate never travels alone. The server also has to send the intermediate certificates that signed it, and the browser follows that chain up to a root in its own store. When an SSL checker reports an untrusted chain, this tool looks for the cause in this order:

• Expired certificate: the date check fails first.
• Self-signed certificate: no root store knows it.
• Expired intermediate: the server still sends an old intermediate.
• Unknown root: the chain ends at a root that is not in the store.
• Incomplete chain: the intermediate is missing or the issuer is not recognized.

In practice, the last case is the one I run into most. During setup someone uploads only the server certificate and skips the full chain file (fullchain) from the issuer. Chrome and some other browsers download the missing intermediate on their own, while Firefox relies on a preloaded list of intermediates. As a result, the site opens on your laptop while mobile apps, payment gateways and bots refuse the connection. I cover the other layers of protection in my website data security and encryption guide.

How do hostname mismatches and wildcard certificates work?

The browser looks for the name in the address bar on the certificate's SAN (Subject Alternative Name) list. Older software checked the CN field; current browsers trust the SAN list only. The tool also follows the same rule and moves the SAN entry that covers your name to the front of the list.

Wildcards follow a strict rule. Under RFC 9525, a wildcard may only be the whole left-most label, and it covers exactly one level:

• *.example.com covers www.example.com and shop.example.com.
• *.example.com does not cover example.com; the bare domain needs its own SAN entry.
• *.example.com does not cover a.b.example.com either; a second level needs another entry.

In practice, the mismatch I see most often is a certificate that lists only the www or only the bare name. A visitor follows an old link to the other version and lands on a full-page warning. So when you order a certificate, put both names on the list. Then check both versions here and use the redirect checker to confirm that they all end at one address.

What should you do if TLS 1.0 and 1.1 are still on?

TLS 1.0 and 1.1 belong to the past. The IETF deprecated both in RFC 8996 in 2021, and current browsers no longer connect with them. However, many servers carry old settings for years. The tool tries a separate handshake for each version and shows an amber warning when an old one answers.

In practice, the fix is usually a single line:

• Nginx: keep only TLSv1.2 and TLSv1.3 on the ssl_protocols line.
• Apache: set SSLProtocol to -all +TLSv1.2 +TLSv1.3.
• cPanel and similar panels: ask your hosting company to change the TLS setting.
• Behind a CDN: raise the minimum TLS version in the CDN dashboard.

If TLS 1.3 is off, the tool only adds a note, because TLS 1.2 with the right cipher suites is still safe. Still, 1.3 shortens the handshake and makes the connection faster. After the change, run the tool again and confirm that all four cards look the way you expect.

How do you set up the HTTPS redirect and HSTS?

A valid certificate does not help a visitor who arrives at the http:// address. For that reason the tool also requests the http:// version and reads the first answer. On a healthy setup, the http:// request goes straight to https:// with a single 301 or 308. A temporary 302, a chain of hops or no redirect at all triggers a warning.

Next, add the second layer: HSTS. The Strict-Transport-Security header tells the browser to open the site over HTTPS only for a set time, so after the first visit an http:// attempt never touches the network. This is the order I recommend:

1. Confirm that every subdomain works over HTTPS.
2. Turn HSTS on with a short max-age and watch it for a few days.
3. Raise max-age to at least one year (31536000 seconds).
4. If you want the preload list, add the includeSubDomains and preload directives.

Do not rush the preload step, because getting off the list again can take months. The hstspreload.org submission rules are explicit: a max-age of at least one year, includeSubDomains and the preload directive. You can check the records of your domain with the DNS lookup tool as well.

Does an SSL checker result affect SEO?

Google has used HTTPS as a ranking signal since 2014. According to the announcement on the Google Search Central blog, it is a lightweight signal that carries less weight than content quality. So HTTPS alone will not lift you to the top. A certificate problem, however, costs you something far more expensive than a position: the visitor's trust.

Since July 2018, Chrome has labeled HTTP pages as Not secure in the address bar. An expired certificate or a name mismatch goes further and shows a full-page warning. As a result, most visitors turn back at that point, ad budget goes to waste and forms stay empty. On top of that, Googlebot cannot crawl pages it cannot reach over a secure connection.

Add an SSL checker run to your list whenever you move a site or change the domain. Do not switch DNS before the certificate, chain and redirect are ready on the new server. I collected the other steps in my website migration SEO checklist. If you want to look at how your technical setup affects rankings, see my SEO consulting page.