SSL/TLS Certificate Checker
Test that a site's HTTPS connection succeeds and see its newest certificate from Certificate Transparency logs: issuer, validity, days left, names.
What is SSL Certificate Checker?
This SSL checker answers two questions: does an HTTPS connection to the host succeed with a certificate that standard TLS validation accepts, and what is the newest valid certificate published for the name? It shows the issuer, validity period, days remaining, all names (SANs) on the certificate and whether HSTS is sent.
How to use SSL Certificate Checker
- Enter a host name such as
example.com(a full URL also works). - Press Check.
- Read the HTTPS connection test result and HSTS header.
- Review the newest certificate's issuer, valid-from and valid-until dates, days remaining and covered names.
When to use SSL Certificate Checker
Use it to check upcoming expiry, confirm a renewal was issued, or see which CA and SANs a domain uses. Because the dates come from CT logs, the server might still present an older certificate than the newest logged one; for the exact certificate served, inspect it in your browser's padlock or with openssl s_client.
How SSL Certificate Checker works
JavaScript in a browser cannot read a server's certificate, so the tool combines two sources. First, AlgoKit's Pages Function opens https://host/; Cloudflare's runtime validates the certificate chain and hostname, so a successful response means the certificate is currently trusted. Second, your browser queries public Certificate Transparency logs through the Cert Spotter API (falling back to crt.sh) for unexpired certificates covering the name, including wildcards, and shows the most recently issued one.
Common Use Cases
- See how many days are left before a certificate expires.
- Verify that Let's Encrypt or another CA actually issued the renewed certificate.
- Check which subdomains are listed in a certificate's Subject Alternative Names.
- Confirm HTTPS works and HSTS is enabled after moving to a new host.
Security Note
The host name is sent to AlgoKit's server for the HTTPS test and to Cert Spotter / crt.sh for the log query.
FAQs
What is Certificate Transparency?
Publicly trusted CAs must log every certificate they issue in append-only CT logs. Browsers reject certificates that are not logged, so the logs list all valid certificates for a domain.
Why might the dates differ from my browser's padlock?
If a certificate was renewed but the server has not been reloaded, the server still serves the older one while the CT logs already show the new one.
Can it check certificates on internal servers?
No. Private addresses are blocked and internal CAs do not publish to CT logs.