SSL Certificate Checker
Inspect an HTTPS site's TLS certificate — issuer, validity, expiry, SAN list, cipher.
Written by Anil Gautam · Updated
How does the SSL check work?
The check runs on a server. Your host and port go to OneClickUse's API, which passes them to a network lookup service that opens a TLS connection to the site and reads the certificate it presents. Because that connection starts on the public internet, hosts that exist only on your own network, such as an intranet name or a 192.168 address, cannot be checked. Type the bare host name, such as example.com, without https:// or a path. Port 443 is the default; change it to check a service that speaks TLS on another port, such as 8443.
How do I read the expiry countdown?
A certificate that validates gets a summary card, and the line beneath its heading shows host:port and the negotiated TLS version. Subject is the name the certificate was issued to, Issuer is the certificate authority that signed it, and Cipher gives the cipher suite with its strength in bits. The serial number identifies this exact certificate, which helps when a hosting panel lists more than one.
Expires in counts days from your device clock to the end of validity, rounded to the nearest whole day. A certificate valid until 23:59:59 UTC on 20 December 2026, checked at 06:30 UTC on 7 October 2026, shows 75 days in green. Below 30 days the card turns red and the heading changes to Expiring soon. The Valid from and Valid until boxes use your local time zone, so a visitor in India sees 21 Dec 2026 for that same certificate, since 23:59 UTC is already the next morning there.
What do the SAN entries tell me?
Browsers match the name in the address bar against the subject alternative names, so this list decides where the certificate works. A wildcard such as *.example.com covers one level: shop.example.com matches, while example.com itself and dev.shop.example.com need entries of their own. Anyone who reaches the site on a name missing from the list sees a warning even when every other detail is fine.
After renewing, run the check again. If the old expiry date still shows, the server is still presenting the old certificate, often because the web server was not reloaded after the new one was installed. When the certificate looks right but visitors still see warnings, follow the redirects with Redirect Chain Checker, because each HTTPS hop is checked against its own certificate. DNS Lookup confirms where a host name points, and WHOIS / RDAP Lookup shows when the domain registration itself expires.