Try digitalgreenhouse.com.au or a broken one, expired.badssl.com. A web address works too; subdomains are checked as typed.
Certificate for
The check runs from our server, because a web page can’t read another site’s certificate itself. We open a connection to the site on port 443 and read the certificate it offers; nothing is sent to the site except a normal secure-connection request. Our code doesn’t keep a record of what you check or who asked. Each result is reused for 5 minutes.
Using an AI agent or a script? Call this tool as an API
AI agents and scripts can call this tool directly, to check their work or look something up, and get JSON back with the same answer this page gives. No key needed.
GET https://digitalgreenhouse.com.au/api/tools/ssl-checker?domain=digitalgreenhouse.com.audomain— string, required. Host name to check. A URL also works; its host is checked (subdomains are checked as given, not reduced to the registered domain). Also accepted asd,host,url.
The API answers from our server, and our code doesn’t store what you send. Fair-use limits apply. API guide · all endpoints (JSON) · OpenAPI
What an SSL certificate does
The padlock in your browser means the connection to the site is encrypted and that the site proved who it is with a certificate. The certificate names the domains it covers and is signed by a certificate authority (CA) that browsers trust, such as Let’s Encrypt, Sectigo or DigiCert. If it has expired, doesn’t cover the name in the address bar, or can’t be traced back to a trusted CA, visitors get a full-page security warning and most of them leave.
“SSL” is the old name. The protocol is now called TLS, but the certificates are the same thing and everyone still calls them SSL certificates.
Reading the result
- Expires is the last moment the certificate is valid. Most certificates are renewed automatically by the host; if the date is close and nothing has changed, the automatic renewal has probably stopped working.
- Covers lists every name on the certificate. A name starting
*.is a wildcard that covers one level, so*.example.comcoversshop.example.combut notexample.comitself ora.b.example.com. The tool also tells you whether thewwwversion (or the bare domain) is covered. - Chain is the certificates the server sends: the site’s own, then one or more intermediates that link it to a CA root built into browsers. A missing intermediate is a common fault after a certificate is installed by hand. It can look fine in your browser and still fail in apps, scripts, payment gateways and other servers.
- Connection shows the TLS version and cipher our server agreed with the site. TLS 1.2 and 1.3 are current; TLS 1.0 and 1.1 are switched off in browsers.
- Validation shows how much the CA checked: DV (control of the domain only), OV or EV (the business behind it too). All three get the same padlock and the same encryption.
- What it doesn’t check: whether the CA has revoked the certificate, and whether browsers have stopped trusting a particular CA that is still in standard trust lists. It also sees only port 443 and the TLS version our server agreed, not every version the site allows.
My browser shows the padlock, but the checker says the chain is incomplete. Who’s right?
Both. Some desktop browsers quietly download a missing intermediate certificate or remember one from another site, so the page works for you. Apps, scripts, payment gateways, email systems and other servers often don’t, so they refuse to connect. Install the full chain (your CA or host calls it the “CA bundle”, “intermediate certificate” or “fullchain”) and check again.
Why do certificates expire so often now?
Shorter certificates limit the damage if a key is stolen or a certificate is issued by mistake. The browser makers and certificate authorities agreed to shorten the maximum life in steps: 200 days for certificates issued from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Free certificates from Let’s Encrypt already last 90 days or less. The answer is automatic renewal, which cPanel’s AutoSSL and most hosts do for you.
The certificate expired. What do I do?
On cPanel hosting, open SSL/TLS Status and run AutoSSL; it usually fails because the domain’s DNS no longer points at the host, or a firewall or redirect blocks the CA’s check. If you bought the certificate, renew it with the seller and install the new one with its CA bundle. Then check here again; results refresh after 5 minutes.
It says the name doesn’t match, but the site works without www.
A certificate only covers the names listed on it. If
example.com is covered but www.example.com isn’t, anyone who types the www version gets a warning, even if the site would redirect them. Add both names to the certificate (AutoSSL does when both names point at the host), and redirect one to the other.Is a free certificate as good as a paid one?
For encryption, yes. A free Let’s Encrypt certificate encrypts exactly as well as a paid one, and browsers show the same padlock. Paid certificates add organisation or extended validation, longer support and sometimes a warranty, which some businesses and tenders require.
Can it check a mail server or another port?
Not yet. The checker connects on port 443, the port websites use, and only to addresses on the public internet. For email, our MX & email setup check covers the DNS side.