Free Tools / SSL Validation
SSL Validation
Check an SSL/TLS certificate: validity, expiry date, issuer, certificate chain, hostname match and supported TLS versions. Checked from Upzilla’s servers, no login needed.
✓
Check an SSL/TLS certificate: validity, expiry date, issuer, certificate chain, hostname match and supported TLS versions. Checked from Upzilla’s servers, no login needed.
Start and end dates with the days remaining.
Leaf, intermediate and root certificates as the server presents them.
Whether the certificate covers the domain you entered.
Key type and size (RSA, ECDSA) and weak-key warnings.
Negotiated version and cipher, plus TLS 1.3, 1.2 and legacy 1.0/1.1 support.
Every domain listed on the certificate (SAN).
| Problem | Cause | Fix |
|---|---|---|
| Certificate expired | The validity period ended and nobody renewed it. | Renew or re-issue the certificate and reload the web server. Set up expiry monitoring so it never repeats. |
| Name mismatch | The certificate does not list the domain visitors use (for example www is missing). | Re-issue a certificate that includes every hostname, or use a wildcard or multi-domain certificate. |
| Incomplete chain | The server sends the leaf certificate but not the intermediate certificate(s). | Install the full chain (fullchain.pem) so clients can build the path to a trusted root. |
| Self-signed certificate | The certificate was signed by itself rather than by a trusted authority. | Replace it with a certificate from a public CA such as Let’s Encrypt. |
| Untrusted root | The chain ends at a root certificate that browsers do not know. | Use a certificate from a publicly trusted CA, or install your private root on client devices. |
| Old TLS versions | TLS 1.0 and 1.1 are still enabled. | Disable them and allow TLS 1.2 and 1.3 only. |
It connects to the server the way a browser does and reads the certificate chain. It reports whether the certificate is valid and trusted, when it expires, who issued it, which names it covers, the key type and size, the negotiated protocol and cipher, and which TLS versions the server accepts.
The result shows the exact expiry date and days remaining. To be alerted automatically before it expires, add an SSL certificate monitor in Upzilla.
The usual causes are an incomplete chain (a missing intermediate), a name that is not on the certificate, or an expired certificate served by a different server node. Check each host name and every load-balanced server.
Yes, ports that use TLS directly, such as 465 (SMTPS), 993 (IMAPS), 995 (POP3S), 636 (LDAPS) and 8443. STARTTLS on ports 25, 587 and 143 is covered by the SSL certificate monitor.
No. The check is run on request and the result is not saved.
Upzilla checks your certificates on a schedule and warns you days before they expire. 10 monitors free.