SSL Certificate Checker
Check the TLS / SSL certificate of one or many hosts at once, two ways. Check expiry looks up a host in the public certificate-transparency records — fast and handles many hosts at once, but it reports recorded certificates, which may not be the one the server is actually serving right now. Deep scan connects to the server itself via our service to read the certificate it is really serving today, plus an A–F security grade, one host at a time.
Check expiry — fast, batch lookup of the recorded certificates for your hosts. Deep scan — the real certificate each host is serving now plus a grade; our server does the checking, one host at a time.
| Host | Grade | Issuer | Valid from | Expires | Days left | Status |
|---|
How To Use
- Paste one host per line (e.g.
example.com). Schemes, paths and ports are stripped automatically. - Click Check expiry for a fast Certspotter batch lookup (most recently issued, non-revoked cert per host), or Deep scan (SSL Labs) for the real served certificate and an A–F grade.
- Read the Days left and Status badges: Expiring soon = under 30 days, Expired = past expiry.
Usage Example
Input:
example.com example.org
Example rows after a Certspotter expiry check (dates vary by lookup):
Host Issuer Expires Days left Status example.com Sectigo RSA DV CA 2026-12-02 220 Valid example.org Let's Encrypt E5 2026-09-25 24 Expiring soon
Example rows after an SSL Labs deep scan (grades vary by day):
Host Grade Issuer Expires Days left Status example.com A DigiCert TLS RSA 2026-12-02 220 Valid example.org B Let's Encrypt E5 2026-09-25 24 Expiring soon
Certspotter reports the most recently issued non-revoked cert; SSL Labs reports the cert currently being served plus its grade.
Frequently Asked Questions
Why does it return a recently issued certificate?
Certspotter reads the certificate-transparency logs, which hold every certificate that has been issued for a host — including old ones that are already superseded. To best reflect what a site likely uses now, this tool picks the most recently issued non-revoked certificate (a renewal is issued right before it is deployed).
Is this a live check, or an approximation?
It is an approximation, not a live handshake. A CT log records that a certificate was issued, not that the server is already serving it. Renewals are usually issued shortly before they are switched on, so the most recently issued certificate is the closest guess to what a site runs today — but if a site has just renewed and not yet swapped it in, the result can differ by up to a few days from the certificate currently being served.
What do the status badges mean?
Valid = more than 30 days until expiry; Expiring soon = under 30 days; Expired = already past the expiry date; Unavailable = a scan returned a grade but no parseable expiry; Error = the lookup failed (timeout, rate limit, or no certificate found) — other hosts still complete.
Does this upload my hosts?
Yes — checking a certificate requires asking the Certspotter and/or SSL Labs APIs, so the hosts you type are sent there. No server in this project stores your lookups, and nothing else leaves your browser.
What is the difference between the two buttons?
Check expiry looks up your hosts in the public certificate-transparency records. It runs from your browser, is fast, and handles many hosts at once — but records only show certificates that have been issued, so they may not match the one a server is actually serving right now.
Deep scan connects to each host itself (the request is made on our server side, so any browser can use it) and reads the exact certificate the server is serving today, plus an A–F security grade. It is the accurate option, but processes one host at a time and takes longer.
Does it need a proxy or an API key?
No API key is required for either. Check expiry runs directly from your browser. Deep scan is carried out on our server side, so no extra setup or extension is needed on your end.