example.com or
https://www.example.com, to see its security certificate.:8443). Private and internal addresses cannot be checked. Nothing you
enter is stored. All times are shown in UTC.
A certificate proves that a website really is the name in your address bar, and holds the public key that your browser uses to set up an encrypted (HTTPS) connection. It is issued by a Certificate Authority (CA) that browsers trust. The name SSL is still widely used, but every modern connection uses its replacement, TLS.
• Names covered : every website name the certificate is valid for. If the name you
typed is not in this list (or covered by a *. wildcard), browsers will warn.
• Valid from / Valid until : outside these dates the
certificate is rejected.
• Validation level : how much the CA checked before issuing it (see below).
• Public key : RSA 2048 bits or more, or EC 256 bits (P-256) or more, is
considered strong.
• SHA-256 fingerprint : a unique identifier for this exact certificate, useful
for confirming you are looking at the same one somewhere else.
• Protocol : TLSv1.3 or TLSv1.2 are current. TLS 1.0 and 1.1 are
obsolete and blocked by modern browsers.
• Domain Validation (DV) : the CA only checked that the requester controls the website
name. Free certificates from Let's Encrypt and cPanel AutoSSL are DV.
• Organisation Validation (OV) : the CA also checked that the organisation named in the
certificate exists.
• Extended Validation (EV) : a stricter check of the organisation. Browsers no longer show
it any differently from DV or OV, so it gives visitors no extra visible assurance.
All three give the same strength of encryption.
CAs do not sign website certificates with their root certificate directly. They use an
intermediate certificate, which is signed by the root that is built into browsers and
operating systems. The server must send its own certificate and the intermediates. A very
common fault is a server that leaves out the intermediate: desktop browsers often work around
it, but phones, apps, curl and other servers fail with an untrusted
certificate error.
The CA/Browser Forum, which sets the rules for public certificates, has voted to reduce the maximum lifetime of a certificate in stages:
Issued before 15 Mar 2026 : 398 days
From 15 Mar 2026 : 200 days
From 15 Mar 2027 : 100 days
From 15 Mar 2029 : 47 days
Renewing by hand will become impractical, so use automatic renewal: Let's Encrypt with an ACME client such as Certbot, or AutoSSL if your hosting uses cPanel. Check the Lifetime line above to see how long your current certificate was issued for.
NET::ERR_CERT_DATE_INVALID : expired, or not valid yet
NET::ERR_CERT_COMMON_NAME_INVALID : the name is not covered
NET::ERR_CERT_AUTHORITY_INVALID : self-signed, unknown CA or missing intermediate
SSL_ERROR_BAD_CERT_DOMAIN : Firefox, the name is not covered
SEC_ERROR_UNKNOWN_ISSUER : Firefox, unknown CA or missing intermediate
Every publicly trusted certificate is recorded in public Certificate Transparency logs before browsers will accept it. You can search the logs at crt.sh to see every certificate ever issued for your domain, which is a good way to spot one you did not request.
With OpenSSL installed (it comes with Git for Windows, macOS and Linux):
openssl s_client -connect example.com:443 -servername example.com -showcerts < /dev/null
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
Always include -servername. Most servers host many websites on one address and
use the name (SNI) to choose which certificate to send.