Tools · Free
Check any site’s SSL certificate: its validity, who issued it, and when it expires
We connect to the site the way a browser does, read its certificate, its chain and the versions it accepts, and give it a grade from A+ to F, along with what needs fixing.
Type the site name and press “Check”: the grade and the certificate’s start and end dates appear here.
Chain of trust
From your site’s certificate to a root the browser trusts
Each certificate vouches for the one before it: the site’s certificate, then the intermediate, then the root stored in the browser. If a link is missing, the browser doesn’t trust the site.
The chain appears after the check.
Certificate report
What’s sound in your certificate, and what needs fixing
Ten checks a browser runs before it opens a site, and what each result means.
- ValidityIs the certificate within its term, and how much time is left?
- Issued termWas it issued for a term browsers accept?
- NameDoes the certificate cover the site name being checked?
- TrustDoes the chain reach a root browsers trust?
- Chain completenessDoes the server send the intermediate certificates?
- TLS versionsDoes the server accept only modern versions?
- KeyIs the key a safe length and type?
- SignatureWere the certificates signed with an algorithm that can’t be forged?
- HSTSDoes the site require the browser to use HTTPS?
- RedirectDoes http:// send visitors on to https://?
Results appear after the check.
Protocols
Which TLS versions the server accepts
We connect with each version separately. Modern versions are faster and more secure; retired ones should be turned off.
- TLS 1.3The newest and fastest, supported by every modern browser.Not checked
- TLS 1.2Still secure, and needed by older devices.Not checked
- TLS 1.1Retired since 2021: should be turned off.Not checked
- TLS 1.0Retired since 2021: should be turned off.Not checked
HSTS
HSTS
Tells the browser to open the site only over HTTPS, so your visitor can’t be downgraded to an unencrypted connection.
Redirect to HTTPS
Anyone who types the site name without https:// lands on http://, and the redirect moves them to the encrypted connection.
Covered names
Every name this certificate covers
A certificate is valid only for the names written in it. The asterisk covers one level: *.qahwat-rainbow.com covers shop.qahwat-rainbow.com, but not qahwat-rainbow.com itself.
The names appear after the check.
After the check
FAQ5 questions
Questions about the SSL checker
Didn’t find your answer? Our technical support team is with you around the clock.
Contact supportF: browsers don’t trust the certificate (it has expired, doesn’t cover the name, or its chain doesn’t reach a trusted root). C: the certificate is sound, but the server accepts TLS 1.0 or 1.1, or its key is weak. B: sound, but missing HSTS or the redirect to HTTPS. A: sound, with a good setup. A+: all that, plus HSTS for at least six months and a redirect to HTTPS.
Some browsers fill in a missing intermediate certificate on their own, but older apps and devices and developer tools don’t, so they fail to connect. Install the intermediate certificate with your site’s certificate.
Any site that answers on the internet, whatever its extension, on the HTTPS port or on the cPanel and mail ports.
No. We connect to the site as any visitor does, and read only its public certificate and headers.
Print a PDF report with the Illevante logo: it carries a number, a digital signature and a QR code that anyone can use to verify it on the report verification page.
Your site’s certificate, as the browser sees it
Check any site for free, print a signed report, and choose a new certificate when you need one.
- Checks in every report
- 10
- TLS versions we test
- 4
- Top grade
- A+