SSL Certificate Checker

An SSL certificate (strictly, a TLS certificate) proves to a browser that it is talking to your domain, and lets the connection be encrypted. This checker connects to your site on port 443 the same way a browser does, reads the certificate your server sends, and tells you in plain English whether it is valid, when it expires, and what to fix.

What the SSL checker looks at

• Expiry date and days left. An expired certificate takes the whole site offline for most visitors. Less than 14 days left on a free certificate usually means automatic renewal is failing, because renewal normally happens around 30 days before expiry.
• Name match, including www. The certificate has to list the exact name in the address bar. example.com and www.example.com are different names. A certificate for one does not cover the other unless both are listed (or it is a wildcard such as *.example.com, which covers www.example.com but not example.com itself).
• Certificate chain. Your server must send your certificate plus the intermediate certificate that links it to a trusted root. If the intermediate is missing, some browsers and most apps refuse the connection.
• Self-signed or untrusted. A certificate that signed itself, or that comes from a private authority, is not trusted by any public browser.
• Issuer, key and signature. Who issued it, whether the key is RSA 2048-bit or stronger (or ECDSA), and that it is signed with SHA-256 or better rather than retired SHA-1.
• TLS versions. TLS 1.2 and 1.3 are current. TLS 1.0 and 1.1 are retired: browsers no longer use them and PCI compliance scans fail on them.
• HTTP to HTTPS redirect and HSTS. Whether http:// visitors are sent to the secure address, and whether the site tells browsers to always use HTTPS from then on.

Why does my browser say "Not secure"?

Chrome, Edge, Firefox and Safari use slightly different wording, but the causes are the same.

1. The page loaded over plain http. If someone types your domain or follows an old link, they may land on http://. Chrome labels every http page "Not secure". Fix it with a permanent redirect to https (below).
2. The certificate expired. You will see "Your connection is not private" and NET::ERR_CERT_DATE_INVALID. Renew it.
3. The certificate is for a different name. NET::ERR_CERT_COMMON_NAME_INVALID usually means the certificate covers example.com but the visitor typed www.example.com, or the hosting company is serving its own default certificate because yours is not installed for that domain.
4. The chain is incomplete or untrusted. NET::ERR_CERT_AUTHORITY_INVALID appears for self-signed certificates and private authorities. A missing intermediate can show the same error on phones and in Firefox while desktop Chrome looks fine, which is why it is often missed.
5. Mixed content. The page itself is https, but it loads an image, script, stylesheet or iframe over http://. Browsers block insecure scripts and frames, upgrade or block insecure images, and may remove the padlock. This checker does not crawl your pages for mixed content; see how to find it below.
6. The visitor's clock is wrong. If only one person sees a date error, check the date and time on their device before changing anything on the server.

How to renew an SSL certificate

cPanel hosting. Open SSL/TLS Status and click Run AutoSSL. If AutoSSL fails for a domain, the usual cause is that the domain's DNS no longer points at that server, or a security rule blocks the /.well-known/acme-challenge/ path.

Your own server with Let's Encrypt. Run sudo certbot renew --dry-run to see whether renewal works, then sudo certbot renew and reload the web server (sudo systemctl reload nginx or sudo systemctl reload apache2). Most installs renew from a systemd timer or cron job; check it is still enabled with systemctl list-timers | grep certbot.

Cloudflare in front of the site. Visitors see Cloudflare's edge certificate, which Cloudflare renews for you. Check SSL/TLS → Edge Certificates. The certificate on your origin server still has to be valid if your SSL mode is Full (strict).

Managed WordPress hosts. Most issue free certificates automatically. If one has expired, open a ticket and quote the expiry date from the checker.

How to fix a missing intermediate certificate

The fix is to install the full chain rather than only your own certificate.

• nginx: point ssl_certificate at the full chain file, for Let's Encrypt /etc/letsencrypt/live/example.com/fullchain.pem, not cert.pem. Then sudo nginx -t && sudo systemctl reload nginx.
• Apache 2.4.8 or newer: SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem and SSLCertificateKeyFile .../privkey.pem. Older Apache uses a separate SSLCertificateChainFile.
• cPanel: SSL/TLS → Manage SSL sites, select the domain, and paste the intermediate certificates from your provider into the Certificate Authority Bundle (CABUNDLE) box. Click Autofill by Certificate first; it often finds the bundle for you.
• Paid certificate providers email a "CA bundle" or "intermediate" file with the certificate. Install it alongside, or concatenate it after your certificate in one file for nginx.

Run the checker again afterwards: the chain item should read "Complete".

How to force HTTPS

Only do this once the certificate is valid for every name people use.

• WordPress: in Settings → General, set both WordPress Address and Site Address to https://. Then add a server redirect as below.
• Apache / .htaccess, above the WordPress block:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

• nginx, in the port 80 server block: return 301 https://$host$request_uri;
• Cloudflare: SSL/TLS → Edge Certificates → Always Use HTTPS.

When HTTPS has worked everywhere for a while, add HSTS so browsers skip the insecure request entirely: Strict-Transport-Security: max-age=31536000. Start with a short max-age if you are unsure, because a long HSTS policy makes it hard to go back to http.

How to find mixed content

Open the page in Chrome, press F12, and look at the Console for "Mixed Content" messages; each one names the http URL. On WordPress, the usual sources are old image URLs saved in posts, a theme setting, or a hard-coded script. A search-and-replace from http://example.com to https://example.com with a plugin such as Better Search Replace fixes most of it; take a backup first. Our free hacked-site scan also reports insecure resources on the pages it fetches.

Free SSL certificates

Let's Encrypt, ZeroSSL and Google Trust Services issue free certificates that every major browser trusts. Most hosts set them up with one click (often called AutoSSL or "free SSL"), and Cloudflare provides one at its edge. A paid certificate does not encrypt any better. You pay for organisation validation, a warranty, or support.

Certificate lifetimes are shrinking. Under the CA/Browser Forum rules adopted in 2025, the longest a public certificate can last fell to 200 days in March 2026, and will fall to 100 days in March 2027 and 47 days in March 2029. Let's Encrypt also stopped emailing expiry reminders in June 2025. Renewal has to be automatic, and someone has to notice when it breaks. That is what the free reminder under each result is for.

What a valid certificate does not tell you

A padlock means the connection is encrypted and the certificate matches the domain. It says nothing about what the site serves. Hacked WordPress sites with pharma spam, Japanese keyword pages or redirects to scam pages still have valid certificates. If something about the site looks wrong, run the free hacked-site scan. If it is hacked, Emergency Cleanup is $499 flat for most sites.