How to check an SSL certificate is valid

The SSL/TLS certificate proves that visitors are really talking to your website. If it has expired, was issued for a different domain or isn't trusted, browsers show a big warning and visitors leave.

Check your website now

When is a certificate OK?

A "valid certificate" is really the sum of several things. Browsers only accept the connection when all of the following are right; a single error is enough for a warning.

Validity period: the certificate is already valid and hasn't expired yet.
Trusted chain: it was issued by a certificate authority that browsers trust, and the server sends the intermediate certificates along, so the browser can follow the chain up to that authority.
Hostname: the name the visitor opens is listed in the certificate. A wildcard certificate (*.example.com) covers one level of subdomains, but not example.com itself.
Working HTTPS setup: the server offers HTTPS on port 443, redirects http:// to https:// and doesn't load resources over http://. A correct certificate without these settings will still cause problems; see the guide on HTTPS.

Preventing expired certificates

Certificates are only valid for a limited time; Let's Encrypt certificates, for example, last a few months. That makes automatic renewal essential. Most hosting providers and server panels have it turned on by default, but it can quietly fail, for example after a DNS change or a migration.

If your certificate expires, visitors see an error page instead of your website. In that case, renew it right away through your hosting provider or certificate provider.

Untrusted or incomplete chain

A certificate isn't trusted if it's self-signed, or if the server doesn't send the intermediate certificates. Some browsers fill in a missing chain on their own, other devices don't; that's why your site may work on one computer and not on another.

So always install the full chain (often called "fullchain"), not just the certificate on its own.

Certificate for the wrong name

Does your site work on www.example.com but not on example.com (or the other way around)? Then that name is probably missing from the certificate. Request a certificate that covers both names.

Inspect the certificate yourself

With OpenSSL you can see who a certificate was issued to, by whom, how long it's valid and which names it covers (subjectAltName). The -servername option is needed when several websites run on the same server. With -showcerts you can also see whether the server sends the intermediate certificates.

Terminal

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

How SteadyHost rates the certificate

OK: valid, trusted, issued for your domain and valid for more than 30 more days.
Warning: the certificate expires within 30 days.
Problem: expired, not yet valid, issued for a different name, not trusted, or there's no certificate on port 443.
SteadyHost checks the certificate for the name your website uses (example.com, or www if only that exists). SteadyHost checks which TLS versions your server accepts separately (see the guide on TLS versions); cipher suites and certificate revocation are outside the scope of the check.

Check your own website

A free check shows within seconds how your website is doing: availability, HTTPS and TLS, the SSL certificate, security headers, DNS and DNSSEC, domain registration and email security.