Video guide · 22 seconds
Watch: check an SSL certificate
No sound. Each step is captioned on screen and also written out in the guide below.
Data & developer tools Security
SSL Certificate Checker
Paste a certificate or chain to see when it expires, which names it covers, and whether the chain and signatures check out. It's all decoded on this device.
Workspace
Check a certificate locally
Runs locally in your browser. Certificates are decoded and verified on this device, never uploaded, saved, or shared. Never paste a private key.
Or drop a .pem, .crt, .cer, or .der file here (up to 1 MiB). It stays on your device.
Paste the server certificate first, then its intermediates, in order. The root is optional.
Looks good
Checks
Certificates
A quick guide
Check a certificate in three steps
- 01Add the certificate
Paste PEM text or open a .pem, .crt, .cer, or .der file. Add intermediates after the server certificate.
- 02Enter your hostname
Optional, but it checks that the certificate covers the site, the way browsers do.
- 03Read the verdict
Fix anything marked with a cross first. Warnings are worth a look; details are below each check.
Get a site's certificates
Copy them from any server
openssl s_client -connect example.com:443 \
-servername example.com -showcerts </dev/nullPaste every BEGIN CERTIFICATE block from the output. They're already in server order.
Good to know
Frequently asked questions
Can it check my live website?
Not directly: browsers don't let web pages read a site's certificate, and looking it up on a server would mean sending your domain elsewhere. Use the openssl s_client command above to copy the certificates, then paste them here.
What does "signature verified" prove?
That each certificate was really signed by the next certificate's key and hasn't been altered. It's checked with your browser's built-in cryptography (Web Crypto). Algorithms it can't verify, such as RSA-PSS, are marked "not checked", never "passed".
What isn't checked?
Revocation (OCSP and CRLs) and whether the root is in browsers' trusted list. Both need network access or a root store, so this page states them as not checked rather than guessing.
Why is the Common Name ignored?
Browsers only accept the names in the Subject Alternative Name list. A certificate with a hostname in its CN but no matching SAN fails in Chrome, Firefox, and Safari, so this checker follows the same rule.
I pasted my private key by mistake. Is it safe?
The key is never decoded, shown, stored, or sent anywhere; the page removes it before reading the certificates. Still, treat any key you've pasted somewhere as sensitive, and only share certificates.