SSL Certificate Checker

SSL certificates have a limited validity period (typically 90 days to 1 year). When a certificate expires, browsers display a security warning and block access to the site. Expired certificates do not protect communications. Website administrators must renew certificates before they expire. Services like Let's Encrypt offer free 90-day certificates with auto-renewal.

Subject Alternative Names (SANs) are a certificate extension that allows a single SSL certificate to cover multiple domain names. For example, a certificate for example.com might also cover www.example.com, mail.example.com, and *.example.com (wildcard). Modern browsers require SANs — the Common Name (CN) field alone is no longer accepted as valid.

DV (Domain Validated): Only verifies domain ownership. Fast and cheap/free (Let's Encrypt). Good for personal sites.

OV (Organization Validated): Verifies the domain and the organization behind it. Better for businesses.

EV (Extended Validation): Most rigorous — verifies legal identity of the organization. Previously showed a green bar in browsers; now shown in cert details.

A wildcard certificate uses an asterisk (*) in the domain to cover all subdomains at one level. For example, *.example.com covers www.example.com, api.example.com, mail.example.com, etc., but not sub.api.example.com (two levels deep). Wildcard certs save money when you need to secure many subdomains.

A certificate is "not trusted" when it is not issued (or not chained) to a Certificate Authority (CA) that the browser trusts. This can happen with self-signed certificates, certificates from unknown CAs, or if the intermediate certificate chain is incomplete. Browsers maintain a list of trusted root CAs; any cert that can't be traced back to a trusted root is flagged as untrusted.

SSL (Secure Sockets Layer) is the original protocol, but all versions of SSL (SSLv2, SSLv3) are now deprecated and considered insecure. What is commonly called "SSL" today is actually TLS (Transport Layer Security). TLS 1.2 (2008) remains widely supported and secure. TLS 1.3 (2018) is the current standard — it is faster (0-RTT handshake), removes legacy cipher suites, and is considered more secure. TLS 1.0 and 1.1 have been deprecated by all major browsers.

Renewal depends on how your certificate was issued. Let's Encrypt certificates last 90 days and are typically auto-renewed every 60 days by a Certbot cron job or hosting panel (cPanel, Plesk, DirectAdmin all support auto-renewal). Run certbot renew --dry-run to verify your auto-renewal is configured correctly. For paid certificates from CAs like DigiCert or Sectigo, log in to your account and generate a new CSR (Certificate Signing Request) before expiry. Monitor expiry dates proactively — use this tool or set a calendar reminder at 30 and 7 days before expiry.

A wildcard certificate (e.g. *.example.com) covers all subdomains at one level — www.example.com, api.example.com, mail.example.com — but not the root domain itself or deeper subdomains like dev.api.example.com. A SAN (Subject Alternative Names) multi-domain certificate explicitly lists multiple different domains in the certificate, such as example.com, example.net, and otherdomain.org. Wildcards are ideal when you have many subdomains under one domain; SANs are ideal when you manage multiple distinct domains.

A certificate chain error occurs when a browser cannot verify the path from your certificate to a trusted root CA because an intermediate certificate is missing. The fix is to install the complete certificate chain on your server. Most CAs provide a "bundle" or "chain" file when you download your certificate — concatenate your domain certificate with the intermediate certificate(s) in the correct order (domain cert first, then intermediates) and configure your server to serve the full chain. For Nginx, set ssl_certificate to the combined file. For Apache, use SSLCertificateChainFile. Use SSL Labs to verify chain completeness.