AI & security
SSL Certificate Checker
A real handshake: certificate, expiry, protocol and cipher
This opens a real TLS connection to your origin and reads what came back: the negotiated protocol and cipher suite, and the leaf certificate's issuer, validity window, days remaining and subject alternative names.
Try:
- Free, no signupNo account, no card
- No AI in the score986 deterministic rules
- Nothing publishedYour scans stay yours
- Answers in secondsQuick scan, no browser
Two failures it catches that nothing else will. A certificate that does not cover the hostname visitors actually use - the www form when only the apex was issued - produces the same full-page browser warning as no certificate at all. And a renewal that ran successfully but was never reloaded by the web server leaves an expired certificate serving happily until it takes the site down.
The handshake deliberately does not abort on an untrusted chain. Refusing to continue would mean returning nothing for exactly the sites worth reporting on - expired, self-signed, missing an intermediate. The connection completes, the reason is recorded, and a rule decides what it means.
Why this matters
Someone says the site is "not secure". It loads for me.
Certificates renew themselves now, so nobody watches them, and the TLS settings are usually whatever the host configured years ago. When something slips, the browser deals with it before your server hears anything: a full-page warning, or a padlock replaced by the words 'Not secure'. Your logs stay clean, your analytics just dip, and the alarm is a person taking the trouble to tell you.
What it costs you when this is wrong
With HSTS set, there is no way through
HSTS tells a browser never to touch your domain over plain HTTP, and RFC 6797 requires it to treat a bad certificate as fatal - no 'proceed anyway' link. So the day the certificate breaks, your regulars and your own staff hit a dead end while a browser that has never seen the header may still be offered a way in. The first reports contradict each other, which is what makes them hard to believe.
One http:// script and the feature is gone
On an HTTPS page a browser blocks insecure scripts, stylesheets and frames outright, and only flags insecure images and media. A single http:// URL left in a template can therefore remove the cart, the slider or the booking widget while the page still looks broadly right. The only notice is a console message no visitor will ever send you.
TLS 1.0 fails the card-payment questionnaire
RFC 8996 deprecated TLS 1.0 and 1.1 in 2021, and PCI DSS has prohibited them for card handling since 2018. A load balancer still terminating on an old version costs you the security questionnaire and the acquirer's scan, on top of browsers that warn or refuse. You find out when a partner forwards the failed report, not when a customer complains.
Why run it here
No verdict without a handshake
Every certificate rule declares that it needs a live connection, and that connection is given eight seconds. If the origin is plain HTTP, or the handshake times out, those rules report 'not checked' with the reason rather than a pass. An unearned tick on transport security is worse than an obvious gap.
It reads the page, not just the port
A certificate test inspects the host on port 443. The same run also reads your delivered HTML for http:// scripts, stylesheets, frames, images, audio and video, and checks the Strict-Transport-Security header for presence, a max-age of at least a year, and whether it covers subdomains.
Part of one audit, and never listed publicly
This does not grade the chain or enumerate every protocol and suite your server would accept - Qualys SSL Labs' free server test goes deeper on the certificate, and it is better to say so. What you get here is what your visitors' connection actually negotiated, inside a single pass of all 986 rules, scoped to your own browser session: a report becomes public only if the domain's owner asks for one.
This check runs on its own here, and as part of the full audit alongside the other 985 rules. Either way the findings carry their evidence and their citation, and the report is never published or kept.
How to fix SSL certificate problems
Certificate problems are binary in effect: a visitor either sees your site or sees a full-page browser warning telling them not to.
Renew before expiry and automate it. Expiry is the single most common cause of an outage that nobody was watching for.
Serve the full chain, including intermediate certificates. A missing intermediate works in some browsers and fails in others, which makes it hard to diagnose.
Cover every hostname you actually serve, including the www and non-www forms.
Disable TLS 1.0 and 1.1 and any weak cipher suites still enabled.
Redirect all HTTP traffic to HTTPS, then add Strict-Transport-Security so the browser stops trying HTTP at all.
What happens when you run it
Enter your address
Just the domain is enough — example.com, with or without the https. No account, no card, no crawl of your whole site.
We render it like a visitor
Your page opens in a real browser and JavaScript runs to completion, so what gets audited is the page a person actually sees — not the raw HTML your server sent. A screenshot comes back with the report as evidence of exactly what we measured.
You get findings you can act on
Up to 986 checks run against that rendered page. Each finding names the rule, quotes the evidence found on your page, cites the public specification behind it, and says what to change. Nothing is a judgement call — run it twice on an unchanged page and the score is identical.
What runs this check
- Live TLS handshake
Named because provenance is the product. Every finding in your report says which of these produced it, so you can check the reasoning rather than take a score on faith.
What this checks
10 rules · 10 affect your scoreSite is served over HTTPS
CriticalThe page must be served over HTTPS, not plain HTTP.
SEC_HTTPS scoredCompletes a real TLS handshake and checks whether the presented certificate chain validates against the system trust store. A chain that does not validate produces a full-page browser interstitial - the single most damaging thing that can happen to a page, and one no response-header check can detect.
SEC_TLS_CERT_TRUSTED scoredChecks the scanned hostname against the certificate's subject alternative names, including wildcard entries. A certificate that does not cover the hostname triggers the same interstitial as an expired one, and it is easy to miss when the apex and www forms are configured separately.
SEC_TLS_HOSTNAME_COVERED scoredReads the leaf certificate's expiry date from the handshake. An expired certificate blocks the entire site behind an interstitial, and because renewal is usually automated, the failure mode is silent right up until it is total.
SEC_TLS_CERT_NOT_EXPIRING scoredReports the protocol version actually negotiated. RFC 8996 deprecated TLS 1.0 and 1.1 in 2021; browsers now warn or refuse outright, and PCI DSS has prohibited them for card handling since 2018.
SEC_TLS_PROTOCOL_MODERN scoredSubresources loaded over http:// from an https:// page are either blocked outright (scripts, stylesheets, frames) or flagged as insecure (images, media), breaking both the padlock and, often, the page.
SEC_MIXED_CONTENT scoredReports the cipher suite the server actually chose and checks it against constructions with published weaknesses - RC4, 3DES, single DES, export-grade suites, MD5 integrity and anonymous key exchange.
SEC_TLS_STRONG_CIPHER scoredHSTS instructs browsers to always use HTTPS for this domain, preventing downgrade/SSL-stripping attacks.
SEC_HSTS_HEADER scoredA short HSTS max-age leaves a window in which a downgrade attack still works, and preload list submission requires 31536000 or more.
SEC_HSTS_LONG_MAXAGE scoredWithout includeSubDomains, a single insecure subdomain can be used to set cookies for the parent domain.
SEC_HSTS_SUBDOMAINS scored
Questions
- How many days before expiry should I worry?
- Anything under three weeks is flagged. Most certificates renew automatically, so the interesting case is not the countdown itself - it is a countdown that is not moving, which means the automation has silently stopped.
- Does it check the whole chain?
- It reports whether the presented chain validates against the system trust store and why it did not, which is what catches a missing intermediate - the single most common certificate misconfiguration.
Also checks
This page answers these searches too — they are the same job, so they share one page rather than being split across near-identical ones:
- tls checker
- ssl certificate expiry
- https checker
- certificate validity check
Other checkers
- HTML ValidatorW3C markup conformance, checked by a real parser
- CSS ValidatorStylesheets parsed and checked against the W3C property grammars
- Schema Markup ValidatorJSON-LD parsed, expanded to real schema.org IRIs, and checked
- Rich Results TestWhich search features your structured data qualifies for
- Website Scam DetectorThe trust signals people and payment processors check before believing a site
- AI ValidatorWhether AI models can find, read, quote and operate your site
- Broken Link CheckerEvery link on the page requested, with blocked and broken told apart
- SEO CheckerTitles, meta, canonicals, indexability and internal linking
- Accessibility CheckerTwo WCAG engines — one in a real browser, one on your markup
- Security Headers CheckerResponse headers, CSP quality, and the TLS certificate underneath
- Core Web Vitals CheckerMeasured for real, plus the page-weight causes behind the numbers
- AI Agent Readiness CheckerCan an agent find your buttons, read your labels and finish the task
- W3C ValidatorMarkup and stylesheet conformance in one pass
- Answer Engine CheckerWhether AI answer engines can quote you, and attribute it
- AI Crawler CheckerWhich AI crawlers your robots.txt actually lets in
- robots.txt CheckerWhat your robots.txt actually allows, group by group
- Meta Tag CheckerTitles, descriptions, canonicals and robots directives
- Open Graph CheckerHow your link looks when someone shares it
- Image SEO CheckerAlt text, dimensions, formats and lazy loading
- Mobile-Friendly TestViewport, tap targets and responsive behaviour
- Website CheckerEvery module, one scan, one prioritised fix list
Run the ssl certificate checker now
No signup, no credit card. Quick answers in seconds; a full audit takes about a minute.
Run a free scanNo signup. No credit card. Nothing stored but the result.