Free SSL checker (what visitors actually receive)
One live TLS check: expiry, issuer, chain, hostname match, and an A to F TLS grade. Use the SSL checker once for free, or watch the cert continuously so the next failure hits your inbox first. No signup, no email.
CertPost connects to your hostname on port 443 and reads the live certificate directly from the wire. It returns:
- Expiry date and days remaining
- Issuer
- Subject Alternative Names (SANs)
- Chain completeness and validity
- Hostname match
- A TLS configuration grade
No account required. You can also check a custom port if HTTPS is not running on 443.
No signup. No email. Live TLS read of the certificate visitors get.
Why check from outside your server?
Certbot can renew the certificate files on disk while your web server continues serving the old one from memory. The two states diverge silently.
Running openssl s_client locally checks what your server thinks it is serving. Checking from here confirms what a browser, a monitoring service, or a user actually sees.
If the dates differ between your local check and this one, the problem is in your server config, not Certbot.
What to do if the cert looks wrong
Compare the expiry date here against the file on disk:
sudo openssl x509 \
-in /etc/letsencrypt/live/YOUR-DOMAIN/fullchain.pem \
-noout -datesIf the disk date is newer than what this checker returns, your web server is not loading the renewed file. The usual cause is a missing reload after renewal. Full diagnosis: Certbot says it renewed. Your server is still serving the old cert.
What the check covers
The served certificate, not the renewal log
The check opens a real TLS connection and reads what your server sends. A renewal that succeeded on disk but was never reloaded still shows up as the old certificate, because that is what your visitors receive.
Expiry, issuer, and hostname
The expiry date with days remaining, who issued the certificate, every hostname the certificate covers, and whether it matches the domain you checked.
The full chain
Leaf, intermediates, and root are validated together. An expired intermediate breaks visitors even when your own certificate is fine. That is the failure that took down thousands of sites when the AddTrust root expired.
A TLS grade
Protocol versions, cipher strength, key strength, and HSTS, graded A to F with a plain-English finding behind every deduction.
Common questions
Is this SSL checker free?
Yes. The check runs without an account, an email address, or a card. An account is only needed if you want CertPost to keep checking the certificate and alert you before it expires.
What does the SSL checker actually test?
It opens a TLS connection to your server and reads the certificate presented: expiry date, issuer, the full chain including intermediates, hostname and SAN match, protocol versions, and cipher configuration. It checks what your visitors receive, not what your renewal tooling reports.
Can I check a port other than 443?
Yes. Use host:port syntax, e.g. mail.example.com:465. The checker works on any TLS port — SMTP, IMAPS, LDAPS, or an admin panel on 8443.
How is this different from SSL Labs?
SSL Labs grades TLS configuration in depth and takes a minute or two per scan. This check answers the operational questions in seconds — is the certificate valid, when does it expire, is the chain intact — and grades the TLS configuration the same A to F way. CertPost can then monitor the certificate so you hear about problems before visitors do.
What is the difference between an SSL checker and SSL monitoring?
A checker answers "is it OK right now?" Monitoring answers "will I know before customers do?" CertPost is built for the second question; this page is the first. Same wire-level read, on a schedule, with alerts.