### SSL Certificate Checker This sends a network request from your browser to the entered host. It does not inspect certificate expiry, issuer, chain or trust; network and browser policies can block it. _Enter domain (e.g., example.com)_ Check SSL # SSL Certificate Checker - Understand HTTPS and TLS Start a limited browser HTTPS request and learn how to inspect a certificate. This page does not show the issuer, expiry date, fingerprint, domain coverage or certificate chain. Use your browser's certificate viewer or a dedicated TLS inspection tool for those details. Use [DNS Record Lookup](https://www.toolcomb.com/dns-record-lookup) to inspect selected public DNS records, and [HTTP Header Viewer](https://www.toolcomb.com/http-header-viewer) for headers exposed by a permitted browser request. Neither tool independently validates this certificate. ## What is an SSL Certificate and Why Does It Matter? An **SSL certificate** (Secure Sockets Layer certificate, now technically called a TLS certificate - Transport Layer Security) is a digital certificate that authenticates a website's identity and enables an encrypted, secure connection between a web server and a visitor's browser. The padlock icon you see in the address bar of every secure website is proof that an SSL certificate is installed and functioning correctly. SSL certificates work through **public key cryptography**: the certificate contains a public key used to encrypt data sent from the browser to the server, while the server holds a matching private key used to decrypt it. This ensures that sensitive data - login credentials, credit card numbers, personal information - cannot be intercepted and read by third parties, even on compromised networks. Beyond security, SSL certificates are now a foundational requirement for the modern web. Google has used HTTPS as a **ranking signal** since 2014, and browsers display alarming "Not Secure" warnings on HTTP sites, causing users to immediately leave. An expired or misconfigured SSL certificate is one of the most common causes of sudden drops in web traffic, e-commerce sales, and user trust. ## Types of SSL Certificates Explained ### Domain Validated (DV) Certificates The most basic type of SSL certificate. The Certificate Authority (CA) only verifies that the applicant controls the domain - typically through a DNS TXT record or a file placed on the web server. Issued within minutes. **Issuer examples:** Let's Encrypt (free), ZeroSSL (free), Comodo, DigiCert. **Best for:** Blogs, personal websites, development environments, small business sites that don't handle sensitive transactions. Domain control validated ### Organization Validated (OV) Certificates The CA verifies both domain control and the existence and legitimacy of the organization requesting the certificate. Typically takes 1–3 business days. The certificate includes the organization's verified name. **Issuer examples:** DigiCert, Sectigo, GlobalSign, Entrust. **Best for:** Business websites, SaaS applications, customer portals, and any site where users need assurance they're dealing with a real company. Higher trust level than DV ### Extended Validation (EV) Certificates The highest level of certificate validation. The CA conducts thorough vetting of the organization's legal existence, physical location, and operational status. Historically showed a green address bar in browsers (now less visible in modern browsers). **Issuer examples:** DigiCert, Entrust, GlobalSign (premium pricing). **Best for:** Banks, financial institutions, e-commerce platforms, healthcare providers, and any site handling highly sensitive transactions. Highest trust & validation ### Wildcard SSL Certificates A single wildcard certificate secures a domain and all of its first-level subdomains (e.g., `*.example.com` covers `www.example.com`, `mail.example.com`, `api.example.com`, etc.). Extremely cost-effective for organizations with many subdomains. **Limitation:** Wildcard certificates don't cover second-level subdomains (e.g., `app.api.example.com`) and can be revoked if the wildcard private key is compromised, affecting all subdomains. Available as DV or OV ### Multi-Domain (SAN) Certificates Also called UC (Unified Communications) certificates, SAN (Subject Alternative Name) certificates secure multiple different domain names within a single certificate. For example, one certificate can cover `example.com`, `example.net`, `example.org`, and `example.co.uk`. Inspect the certificate in your browser or a dedicated TLS checker to see the Subject Alternative Names and verify coverage; this page does not display them. Ideal for multi-domain management ### Self-Signed Certificates Created and signed by the server owner rather than a trusted Certificate Authority. Free to create but not trusted by browsers - users see a "Your connection is not private" warning. Used legitimately in internal development environments and testing but should never be used on public-facing production websites. A failed browser request can have many causes and does not identify whether a certificate is self-signed. Use a certificate viewer for details. Not trusted by browsers ## What to Check in a Certificate Viewer ### Certificate Expiry Date & Days Remaining A certificate viewer can show its validity dates. This page does not report expiry or days remaining. ### Certificate Validity Status Inspect the domain and certificate chain using a dedicated TLS tool; a browser request here is not a full validity test. ### Certificate Authority (CA) & Issuer Details A certificate viewer can show the issuer and organization; this page cannot retrieve those fields. ### Subject Alternative Names (SANs) A certificate viewer can list covered domain names. This page does not display SAN entries. ### Key Size & Signature Algorithm Review the certificate details in a dedicated viewer. These values are not available to this browser tool. ### Trust Status A completed browser request is not a comprehensive trust assessment, and a failure may have several causes. ### Certificate Fingerprints (SHA-1 & SHA-256) Use a certificate viewer to inspect fingerprints; this page does not provide them. ### TLS Protocol & Serial Number A TLS inspection tool can provide protocol and serial details; this browser request cannot. ## SSL Certificate Best Practices Following SSL certificate best practices is essential for maintaining website security, SEO rankings, and user trust. Here are the most important guidelines: ### Renew Before Expiry Set up automatic certificate renewal and monitor expiry dates. Let's Encrypt certificates expire after 90 days but auto-renew at 60 days. For paid certificates, set renewal reminders 60+ days before expiry to allow time for validation. ### Use SHA-256 or Higher Never use SHA-1 certificates (deprecated since 2017 and rejected by modern browsers). SHA-256 is the current standard. ECDSA (Elliptic Curve) certificates offer equivalent security with smaller key sizes and better performance. ### Use 2048-bit RSA or 256-bit ECDSA Keys 2048-bit RSA keys are the minimum acceptable size. 4096-bit offers more security but slower handshakes. For new deployments, consider ECDSA P-256 which offers better performance and equivalent security to 3072-bit RSA. ### Cover All Subdomains Use wildcard certificates or SAN certificates to ensure every subdomain used in production is covered. A missing subdomain in the certificate causes browser errors and erodes user trust. Verify SAN coverage with a certificate viewer. ### Enable HSTS HTTP Strict Transport Security (HSTS) tells browsers to always connect via HTTPS, preventing protocol downgrade attacks. Implement HSTS with a long max-age (1 year minimum) after confirming your HTTPS setup is stable and permanent. ### Monitor Certificate Transparency Logs Certificate Transparency (CT) logs are public records of every certificate issued. Monitor CT logs for your domain to detect unauthorized certificates issued by rogue CAs - a key indicator of potential phishing attacks against your domain. ## How SSL/TLS Certificates Affect SEO The relationship between SSL certificates and SEO is significant and multifaceted. Google officially confirmed HTTPS as a ranking signal in 2014, and the weight of this signal has grown steadily since. Here's how your SSL certificate directly impacts your search engine rankings and organic traffic: - **HTTPS as a Google Ranking Signal:** Google uses HTTPS as a lightweight ranking signal, acting as a tiebreaker when all other factors are equal. While not a massive ranking factor on its own, it can make a meaningful difference in competitive SERPs. - **Chrome "Not Secure" Warnings:** Google Chrome (used by over 65% of desktop users) shows a prominent "Not Secure" warning in the address bar for any HTTP page that has form fields. This dramatically increases bounce rates and reduces conversion rates, indirectly impacting your rankings through poor user engagement signals. - **Expired Certificates = Traffic Disaster:** When an SSL certificate expires, browsers immediately block access with a full-page security warning. Users cannot proceed without clicking through multiple warning screens. This effectively takes your website offline from a user and crawler perspective, causing rankings to plummet within days. - **Mixed Content Issues:** Serving some resources (images, scripts, CSS) over HTTP while the main page is HTTPS creates "mixed content" warnings. Browsers may block mixed content, breaking page functionality and triggering security warnings that harm user experience and SEO. - **Core Web Vitals & HTTPS:** Modern TLS 1.3 (supported by properly configured certificates) enables faster HTTPS handshakes, contributing to better Largest Contentful Paint (LCP) scores - a Core Web Vitals metric used in Google's ranking algorithm. ## SSL Certificate Frequently Asked Questions ### How often should I check my SSL certificate? Check your SSL certificate at least once a month, and set up automated monitoring to alert you when fewer than 30 days remain before expiry. For critical business websites, check weekly. Many SSL monitoring services (including paid uptime monitoring tools) can automatically alert you before certificates expire, preventing website outages. ### What happens when an SSL certificate expires? When an SSL certificate expires, browsers immediately display a full-page security warning ('Your connection is not private' in Chrome, 'Warning: Potential Security Risk Ahead' in Firefox). Most users will immediately leave without proceeding. Search engine crawlers may also be blocked. This effectively takes your website offline for most visitors and causes rapid ranking drops. ### Is Let's Encrypt SSL as secure as paid SSL certificates? From a cryptographic security standpoint, yes - Let's Encrypt certificates use the same encryption standards (RSA 2048-bit or ECDSA) as paid certificates from DigiCert or Comodo. The difference is in validation level (Let's Encrypt only offers Domain Validated certificates) and warranty (Let's Encrypt has no warranty). For most websites, Let's Encrypt is perfectly adequate. Banks and financial institutions typically require OV or EV certificates for regulatory and trust reasons. ### What is a Subject Alternative Name (SAN) and why does it matter? A Subject Alternative Name (SAN) is an extension to the X.509 certificate standard that allows a single certificate to be valid for multiple domain names. Modern certificates require at least one SAN entry. If your www.example.com subdomain is not listed as a SAN in your example.com certificate, visitors to www.example.com will see a certificate hostname mismatch error. Use a certificate viewer to inspect the SANs; this page does not display certificate details. ### What's the difference between SSL and TLS? SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are both cryptographic protocols for securing internet communications. TLS is the modern, secure successor to SSL. All versions of SSL (SSL 2.0, SSL 3.0) are now deprecated and insecure. Modern 'SSL certificates' actually use TLS 1.2 or TLS 1.3 for the actual connection - the term 'SSL certificate' persists as industry convention despite referring to what is technically a TLS certificate. ## Related Tools Discover more free tools that might help with your next task. [Reverse IP Lookup Resolve an IPv4 address to its reverse DNS PTR hostname Use Tool](https://www.toolcomb.com/reverse-ip-lookup) [DNS Record Lookup Look up DNS records for domains Use Tool](https://www.toolcomb.com/dns-record-lookup) [Lighthouse Score Simulator Estimate a Lighthouse-style performance score from page metrics Use Tool](https://www.toolcomb.com/lighthouse-simulator) [Domain to IP Convert domain names to IP addresses Use Tool](https://www.toolcomb.com/domain-to-ip) [HTTP Header Viewer View HTTP headers for websites Use Tool](https://www.toolcomb.com/http-header-viewer) [Ping Test Test network connectivity and latency Use Tool](https://www.toolcomb.com/ping-test) ### Related guides Read the how-to, then come back to this tool when you are ready to run it locally. - [Why Chrome Says “Not Secure” (and What to Check First) HTTP pages, mixed content, name-mismatch certificates, and expired TLS. How to tell a padlock problem from a DNS problem without scanning hosts you do not own.](https://www.toolcomb.com/blog/why-chrome-says-not-secure) - [How to Check Security Headers on a Live Site CSP, HSTS, X-Frame-Options, cookies, and noindex - what to look for in HTTP headers, how a header viewer helps, and what it will never prove.](https://www.toolcomb.com/blog/how-to-check-security-headers-on-a-live-site) - [Why Your DNS Change Isn’t Showing Yet You updated A or CNAME records but the site still hits the old server. TTL, cache, recursive resolvers, and how to look up public DNS without confusing it with your laptop’s cache.](https://www.toolcomb.com/blog/why-dns-changes-are-not-showing) [View All Tools](https://www.toolcomb.com/tools)