Check a domain’s SSL certificate - expiry date, issuer, covered domains, and whether HTTPS is currently reachable.
To check another service, add its port: mail.example.com:465 or ldap.example.com:636.
Enter a domain to check its SSL certificate
An SSL/TLS certificate is a digital document that verifies a domain’s identity and enables encrypted HTTPS connections. When your browser connects to a site over HTTPS, the server presents a certificate signed by a trusted Certificate Authority (CA). Your browser validates the signature, the expiry date, and that the cert covers the domain you requested - then establishes an encrypted connection.
A single certificate can cover multiple domain names via SANs. A certificate for cloudflare.com might also cover *.cloudflare.com, www.cloudflare.com, and other related hostnames. Wildcard entries (starting with *.) cover any single-level subdomain.
Let’s Encrypt (R3, E1, R10, R11) - free, automated, 90-day certs. Used by the majority of websites today.
Google Trust Services (GTS) - used by Google’s own properties.
DigiCert / Sectigo / Comodo - paid CAs, often used by enterprise and e-commerce sites where longer validity or extended validation (EV) is required.
ZeroSSL - free alternative to Let’s Encrypt, also 90-day certs.
VLANlab's server makes a real TLS connection to the domain and reads the certificate it presents: protocol version, cipher, key, chain and fingerprint. It also asks the issuing CA's revocation services (CRL and OCSP) whether the certificate has been revoked. Certificate Transparency (CT) logs are a public, append-only record of every certificate issued by a CA; this tool also queries CertSpotter, which indexes CT logs, for the certificates issued for the domain. CT data is typically within a few hours of issuance. If a cert was renewed very recently, the CT log entry may not yet reflect it. Whether the domain is on the HSTS preload list comes from hstspreload.org.