Enter any HTTPS URL to inspect its SSL/TLS certificate and view the complete chain of trust
Check SSL/TLS certificates for any website with our free certificate chain viewer. Verify certificate validity, expiration dates, issuing authority, and view the complete certificate chain from root to leaf certificate. Essential for security audits, troubleshooting HTTPS issues, and ensuring proper SSL/TLS configuration.
An SSL/TLS certificate is a digital document that authenticates a website's identity and enables encrypted connections.
The grade reflects protocol support, cipher strength, and certificate chain validity together — an A doesn't mean "no issues," it means no issue serious enough to fail modern security baselines. Check the detail breakdown above for the specific factor pulling a grade down.
"Certificate has expired" means the validity period has passed - renew the certificate immediately. "Certificate not trusted" indicates the chain doesn't link to a trusted root - check intermediate certificates. "Hostname mismatch" means the domain isn't in the certificate's SANs - reissue with correct domains. "Unable to get issuer certificate" suggests missing intermediates - provide the complete chain. Understanding error messages helps diagnose and resolve issues quickly.
Domain Validation (DV) certificates verify only domain control through automated checks - fastest and cheapest. Organization Validation (OV) requires business verification documentation - takes days and costs more. Extended Validation (EV) involves rigorous identity verification - most expensive but browsers no longer prominently display EV status. For most use cases, DV certificates from Let's Encrypt or commercial providers provide adequate security. OV or EV make sense primarily for large enterprises with specific compliance requirements.
Subject Alternative Names list all domains and subdomains covered by a certificate. Modern certificates require SANs even for the primary domain. SANs enable one certificate to secure multiple hostnames like example.com, www.example.com, and api.example.com. Wildcard SANs (*.example.com) cover all subdomains but not the root domain. Always verify SANs include all domains users might access to avoid hostname mismatch errors.
Use this tool or SSL Labs to check certificate expiration dates. Command-line tools like OpenSSL can also check: `openssl s_client -connect example.com:443 | openssl x509 -noout -dates`. Set up automated monitoring with services like UptimeRobot, StatusCake, or certificate-specific monitoring tools. Most certificate providers send expiration reminder emails, but don't rely solely on these - implement independent monitoring and automated renewal.