SSL Checker
A real SSL/TLS checker that opens an actual TLS handshake on port 443 and reads the live certificate chain — no cached or approximate data. See the exact expiry date and days remaining, the issuing CA, whether the chain is complete, the negotiated protocol version (flagging deprecated TLS 1.0/1.1), and the cipher suite (flagging known-weak ciphers). Part of ForgePlug's Site Health Check, which also runs DNS, HTTP security header, and robots.txt checks on the same domain at no extra cost.
This check runs server-side — ForgePlug briefly connects to the domain you enter to read its certificate, DNS records, response headers, and robots.txt/sitemap. We don't store anything beyond a 5-minute result cache (to avoid re-running the same check for everyone hitting a trending domain) and a short-lived snapshot used to compare a re-check later.
How this SSL checker reads your certificate
A real TLS handshake on port 443, not a cached lookup.
Most "SSL checker" pages either scrape a third-party certificate transparency log or reuse a stale cached result. This one opens an actual TLS connection to your domain on port 443 and reads the certificate the server presents right now — the same handshake a visitor's browser performs.
From that handshake it reports the exact expiry date and days remaining, the issuing certificate authority, whether the full chain (leaf → intermediate → root) resolves to a trusted authority, which protocol version was negotiated — flagging TLS 1.0 and 1.1, which modern browsers are actively deprecating — and the negotiated cipher suite, flagging known-weak ciphers like RC4 or 3DES.
Because it's part of ForgePlug's full Site Health Check, submitting also runs a DNS propagation check, an HTTP security header scan, and a robots.txt/sitemap validation on the same domain — all in parallel, at no extra cost.
Frequently Asked Questions
SSL certificate checking, explained
How is this different from a dedicated SSL checker?
What counts as an expiring certificate?
My certificate works in Chrome but fails in curl or my app. Why?
What is a SAN, and why does a valid certificate still show a name mismatch?
Does a certificate expiring mean my site goes offline?
Should I still support TLS 1.0 and 1.1 for older clients?
Is this really free, and is there a limit?
Why does this tool need a server? Aren't ForgePlug's tools all browser-based?
What do you do with the domain I check?
Guides & Articles
Learn how to get the most out of this tool with our in-depth guides.
Tool Overview
A closer look at SSL Checker — how it works, who it's for, and where it fits in your workflow.
An SSL certificate almost never fails gradually. It works perfectly for months and then, at a specific timestamp, every browser and API client hitting your domain starts throwing warnings at once. The failure is binary and it is scheduled — which is exactly why it so often lands on a weekend, during a holiday, or the morning of a launch, when the person who set up the renewal is unreachable.
The more confusing failure is the one where the site looks fine to you and broken to someone else. That is almost always an incomplete chain. A certificate is not a single file: it is your leaf certificate plus one or more intermediate certificates linking it back to a root your client already trusts. Desktop browsers quietly paper over a missing intermediate, because they cache intermediates they have seen elsewhere and can fetch missing ones on the fly. Most non-browser clients do not. So curl, a Java service, an Android app, a webhook receiver, or a payment provider's callback will reject a chain that Chrome renders without a murmur — and you will spend an afternoon insisting the certificate is valid because, on your machine, it is.
This checker opens a real TLS handshake against port 443 and reports what the server actually presented: the leaf certificate's subject and SAN entries, its issuer, the not-before and not-after dates, the chain the server sent, the negotiated protocol version, and the cipher suite. Nothing is inferred from a cached scan or a third-party database — if the result says TLS 1.2 with a particular cipher, that is what the connection negotiated at the moment you pressed check.
It flags the three failure modes that actually cause outages: a certificate that has expired or is close to it, a hostname that is not covered by the certificate's SAN list, and a negotiated protocol or cipher old enough that modern clients have started refusing it. TLS 1.0 and 1.1 are the ones to watch — both are formally deprecated, and browsers and payment processors have been progressively hard-failing them rather than warning.
Key Features
Everything you get with this tool, at a glance.
Live handshake, not a lookup
Connects to port 443 and reads the certificate the server actually presents right now.
Expiry with real headroom
Warns at 21 days remaining and fails once expired, so a silent renewal failure surfaces early.
Full chain inspection
Walks the chain the server sent, so a missing intermediate shows up before a client rejects it.
Weak protocol detection
Flags TLS 1.0/1.1 and known-weak ciphers including RC4, 3DES, DES, MD5, and anonymous DH.
Hostname coverage
Shows the certificate's subject and SAN entries so you can confirm the name you use is covered.
Reads untrusted certificates too
Deliberately inspects expired or self-signed certificates instead of refusing to connect and telling you nothing.
How to Use SSL Checker
Get from zero to done in four quick steps — no account, no learning curve.
Enter the exact hostname clients use
Check the hostname your users and API callers actually connect to. A certificate covering example.com does not automatically cover www.example.com or api.example.com unless those names are in its SAN list.
Read the expiry line first
This is the field with a deadline attached. If it warns, find out why the renewal did not run rather than renewing by hand — a manual renewal fixes today and leaves the same failure scheduled for 90 days out.
Check the chain, not just the leaf
If the chain looks short, suspect a missing intermediate. This is the single most common cause of 'works in my browser, fails in curl' reports from integration partners.
Confirm the negotiated protocol
TLS 1.2 or 1.3 is what you want. If the handshake settled on TLS 1.0 or 1.1, the server is still offering protocols that a growing share of clients will refuse outright.
Re-check from the outside after any change
After renewing or reconfiguring, run the check again rather than trusting a local test. A reloaded config on one node in a load-balanced pool is a classic way to fix the certificate for half your traffic.
Practical Examples
Real input and output pairs so you know exactly what to expect.
Healthy certificate
Input
cloudflare.com
Output
Pass — valid leaf and complete chain, TLS 1.3 negotiated, expiry comfortably beyond the 21-day warning threshold.
Certificate past its expiry date
Input
expired.badssl.com
Output
Fail — the certificate parses correctly but its not-after date is in the past, so conforming clients will refuse the connection.
Hostname not covered by the certificate
Input
wrong.host.badssl.com
Output
Fail — a technically valid certificate that does not list this hostname in its SAN entries, so the name does not match.
Guides & Articles
Learn how to get the most out of this tool with our in-depth guides.
Was this tool helpful?
Your feedback helps us improve SSL Checker for everyone.
Share this tool