To check SSL certificate expiry for any site, enter the domain in this SSL Checker. Bloghints' server connects to the site and reports how many days the certificate has left, who issued it and whether it is valid. It also checks the names it covers, the certificate chain, the TLS version, the http to https redirect and HSTS.
What does an SSL certificate do?
An SSL certificate is a small file on your server that proves your site is really yours. Browsers use it to set up an encrypted connection, the padlock and the https:// in the address bar. People still say "SSL", but the technology today is called TLS (Transport Layer Security). Both words mean the same thing here.
Every certificate has an end date. When it passes, browsers show a full-page warning and most visitors leave. Free certificates from Let's Encrypt last only a short time, so they must renew on their own. If that renewal breaks quietly, you find out when a reader tells you, or not at all.
What the SSL Checker reports
Enter a domain such as example.com. The checker connects from Bloghints' server, the same way a browser would, and reads what your server sends back.
| Check | What a good result looks like |
|---|---|
| Valid certificate | Yes, trusted and not expired |
| Days until expiry | Enough days left, and the number goes back up after each renewal |
| Issuer | The company that signed it, such as Let's Encrypt |
| Names covered (SAN) | Your domain and its www version both match |
| Chain complete | Your server sends the intermediate certificate |
| Self-signed | No |
| Key and signature | The key type and size, and the signature algorithm |
| TLS version | TLS 1.2 or 1.3 |
| http to https | http:// redirects to https:// |
| HSTS | Set, once https works everywhere |
You can also check several domains at once, run a TLS version scan, and see the full certificate chain. Every result can be exported as a CSV file.
How to check SSL certificate expiry and the rest
- Type your domain without https:// or a path, for example
example.com. - Add more domains if you run several sites, one per line.
- Read the expiry first. Note the number of days left and the issuer.
- Look at the names. The tool shows if both
example.comandwww.example.commatch the certificate. - Check the TLS versions row to see whether old TLS 1.0 or 1.1 is still switched on.
- Export the CSV to keep a record or share it with your host.
What to do when a check fails
The certificate expires soon or has expired
Most hosts renew free certificates on their own. If the days left keep falling and nothing changes, the renewal is stuck. Open the SSL or TLS page in your hosting panel and run the renewal again, or ask your host's support. A common cause is a domain that no longer points to the server that asks for the certificate.
The www version does not match
The SAN list, short for Subject Alternative Names, holds every name the certificate covers. If it lists example.com but not www.example.com, anyone who types www gets a warning. Ask for a new certificate that covers both names. Most hosting panels have a box for this.
The chain is not complete
Your certificate is signed by an intermediate certificate, which is signed by a root that browsers trust. Your server must send the intermediate too. Some browsers fill the gap on their own, so the site can look fine on your computer and still fail on some phones or for bots. Install the full chain file your issuer gives you, often called fullchain.pem or a "CA bundle".
The certificate is self-signed
A self-signed certificate was made by the server itself, not by a trusted issuer. Browsers do not trust it, so visitors see a warning. Replace it with a free certificate from Let's Encrypt or the one your host offers.
Old TLS versions, redirects and HSTS
TLS 1.0 and 1.1 are old versions with known weak spots. A standard from the IETF, RFC 8996, deprecated both, and modern browsers no longer use them. If the TLS scan warns that they are still on, ask your host to turn them off and keep TLS 1.2 and 1.3. On a shared host you usually cannot change this yourself.
A good certificate is not enough if people still land on http://. Your server should send every http:// request to the https:// address with a 301 redirect. The .htaccess redirect generator writes that rule for Apache and LiteSpeed.
HSTS (HTTP Strict Transport Security) is a header that tells browsers to use https for your site every time. Add it only after https works on every page, and start with a short time. Our guide on adding HSTS and security headers walks you through it, and the security headers generator writes the code.
Is the padlock all you need?
No. The padlock only covers the main page. If a post still loads an image or script over http://, browsers flag the page as not fully secure. This is called mixed content. Find those files with the mixed content checker, then fix them with the guide to fixing mixed content.
A quick monthly look is enough for most small sites. Check SSL certificate expiry with this tool, make sure the www name and the chain pass, and you will spot a stuck renewal long before your visitors see a warning.
Frequently asked questions
Why does my site work but the checker says the chain is incomplete?
Some browsers remember or download the missing intermediate certificate on their own, so your computer hides the problem. Other devices, apps and bots do not. Install the full chain file from your issuer so every visitor gets it.
How many days before expiry should I worry?
If your certificate renews on its own, the days left should jump back up after each renewal. When the number keeps falling close to the end date, the renewal is likely stuck. Contact your host or run the renewal in your panel right away.
Can I check a site that is not mine?
Yes. The checker only reads what every browser sees when it opens the site, so the certificate is public. That makes it handy for checking a friend's site, a partner site or a site you plan to link to. It changes nothing on the server.
