SSL Checker: is your certificate about to expire?

Type a domain here and within about two seconds you will know four things: the exact expiry date and how many days are left, whether the certificate covers the hostname you typed, whether your server is sending the intermediate certificate as well as your own, and which TLS versions it still accepts. No X.509 dump, no signup, and nothing is changed on your site.

What the result means

“Expires in fewer than 30 days.” Renew now and, more usefully, put renewal on a system rather than on somebody remembering. If your issuer renews automatically on a 90 day cycle, a short number here is normal and the tool says so. Monitoring and renewal are part of every plan on hosting and care.

“Incomplete chain.” Your server is sending your certificate but not the intermediate above it. Desktop browsers usually paper over this, which is why it survives so long, while older phones, API clients and bots see an untrusted site. The fix is a server configuration change, not a new certificate. If you do not have anyone who does server configuration, that is what hosting and care covers.

“Hostname not covered.” The certificate is valid but not for the address people typed, commonly because www was added or dropped after the certificate was issued. Reissue with both names, and make sure one version redirects to the other permanently. DNS Lookup shows which names your domain actually answers on today.

“TLS 1.0 or 1.1 still accepted.” These were retired in 2021 and offering them is pure downside, including for card payment compliance. Turn them off at the server or the edge. On a site we host this is already off.

“Certificate valid, everything green.” Then the next question is whether the rest of the site is as tidy as its certificate. Run the Website Security Scanner, which reads the certificate as one of seven sections.

Certificates in one minute

An SSL/TLS certificate does two jobs. It encrypts the connection between a browser and your server, and it proves identity: that the server answering for yourdomain.com is really yours. That proof works through a chain of trust. A Certificate Authority (CA) your device already trusts signs an intermediate certificate, and that intermediate signs your certificate. A browser trusts your cert because it can follow that chain back to a root it was born knowing.

A few fields on the certificate matter in daily life:

• Common Name and SANs. The hostnames the certificate is valid for. Modern certs carry the real list in the Subject Alternative Name (SAN) field. If the host you typed isn’t in it, browsers reject the cert with a name-mismatch error, even though everything else is fine.
• Validity window. A not-before and a not-after date. Public certificates now max out at ~398 days of validity, so renewal is a recurring fact of life.
• Key and signature. The key type and size (RSA 2048, EC P-256) and the signature algorithm. A SHA-1 signature or a sub-2048-bit RSA key is a red flag on any modern certificate.

The chain is where it quietly breaks

The single most common “it works for me but not for them” bug is an incomplete chain. Your server is supposed to send your certificate and the intermediate certificate(s) above it. Desktop Chrome and Safari often paper over a missing intermediate by fetching it themselves, so it looks fine on your laptop. But many Android versions, older devices, curl, and the API clients and bots that talk to your site machine-to-machine can’t do that fetch, and they see an untrusted certificate. SSL Checker inspects the chain the server actually serves, not the idealised one, so a missing intermediate shows up before your integrations start failing.

Expiry is an outage waiting on a calendar

An expired certificate is one of the most damaging avoidable outages there is: every visitor hits a full-page browser warning, most leave instantly, and every API or webhook that calls you starts failing at the same moment. It’s entirely preventable. The expiry countdown is the first thing this tool shows, colour-coded: comfortable above 30 days, warning inside a month, alarm inside a week or already expired. If your issuer is an automated CA like Let’s Encrypt or ZeroSSL (certificates that renew every 90 days), the tool notes it, because a short validity window is a feature there, not a problem. The durable fix for everyone else is monitoring plus auto-renewal. Don’t rely on remembering.

TLS versions: which handshakes your server still speaks

TLS has four versions you’ll see in the wild, and the guidance is simple. TLS 1.2 and 1.3 are current and good. TLS 1.0 and 1.1 were deprecated in 2021, are refused by up-to-date clients, and fail PCI-DSS compliance; offering them is pure downside. SSL Checker probes each version and badges what the server offers. One honest caveat it surfaces: a modern server stack sometimes can’t even test an ancient protocol because its own libraries refuse to speak it, so the tool says “couldn’t test” rather than pretending a version is absent. For the deep cipher-suite audit a security team needs, SSL Labs remains the gold standard and takes a couple of minutes; this tool gives you the everyday 95% in seconds.

For AI agents

This tool exposes a plain-text endpoint designed for language models and agents:

GET https://nitrosites.com/tools/ssl-checker/scan.php?url=<target>&format=agent

It returns a token-cheap digest of the same analysis shown on this page. Soft rate limits apply; results are cached briefly. No key or login required.

Frequently asked questions

How do I know when my certificate expires, without checking by hand every month?

Run the domain here once to see the date, then put the renewal on automatic. Certificates issued by an automated authority renew themselves on a 90 day cycle. If yours does not, a monitoring plan is the only thing that reliably stops this.

My site looks fine in Chrome. Why does this say there is a problem?

Almost always an incomplete chain. Desktop Chrome fetches the missing piece for you. Older phones and machine to machine clients cannot, so the site is broken for them and perfect for you.

Who is supposed to fix this, me or my host?

Expiry and chain are the host's or server administrator's job. If nobody has that job on your site right now, that is the actual finding.

What happens when an SSL certificate expires?

Browsers show a full-page security warning and most visitors leave immediately. APIs and integrations that call your site start failing too. It's one of the most damaging avoidable outages a site can have.

What is an incomplete certificate chain?

Your server must send the intermediate certificate(s) alongside your own. Some browsers paper over a missing intermediate, but many devices, bots and API clients can't, so the site "works on my machine" while quietly failing for others. This tool checks the chain the server actually serves.

Should TLS 1.0 and 1.1 be disabled?

Yes, they've been deprecated since 2021 and fail PCI-DSS compliance. Your site should offer TLS 1.2 and 1.3 only; this checker shows exactly what's on offer.

Is this the same as an SSL Labs scan?

No, SSL Labs runs a deep multi-minute cipher audit and is excellent for security teams. This tool gives you the 95% you usually need (validity, expiry, chain, protocols) in about two seconds.