Free tool · No signup

SSL Certificate Checker

Enter a domain and instantly see when its TLS certificate expires, who issued it, and whether it's time to renew — expired certificates included.

One live TLS handshake per check — nothing is stored, no account needed.

How this SSL checker works

When you run a check, our server opens a real TLS connection to the host on port 443 — exactly like a browser does — and reads the certificate the server actually presents during the handshake. That's an important detail: we report what is really being served right now, not what a certificate authority issued or what your renewal automation believes it deployed.

Every X.509 certificate carries a validity window (notBefore and notAfter). Once the notAfter timestamp passes, every modern browser and HTTP client rejects the connection outright — there is no graceful degradation. Since public certificate lifetimes are now capped around 13 months and moving toward 90 days, renewals happen often, and every renewal is an opportunity for something to fail silently.

The thumbprint shown is a unique fingerprint of the certificate. It changes on every renewal, which makes it the definitive proof that a new certificate was actually deployed to the server — not just issued. If you renewed but the thumbprint didn't change, the old certificate is still being served.

Never get surprised by an expired certificate again

ContinuumNexus checks your certificates on every HTTPS check and emails you 30, 14, 7 and 1 day(s) before expiry — with automatic reset when the certificate is renewed. Free on the Hobby plan.

Start monitoring free Read the SSL monitoring guide

Frequently asked questions

How do I check when my SSL certificate expires?
Enter your domain above and run the check: the tool opens a TLS connection to your server and reads the expiration date (notAfter) directly from the certificate being served, along with the issuer, subject and thumbprint.
Can this tool check an already-expired certificate?
Yes. Unlike a browser, our probe deliberately accepts invalid certificates during the handshake so it can read and report them — you'll see exactly how many days ago the certificate expired instead of just a connection error.
Why does the checker show a different certificate than the one I renewed?
Because we read what the server actually presents. Renewal automation often issues a new certificate but fails to deploy it to the load balancer or CDN. Compare the thumbprint: if it hasn't changed since before the renewal, the new certificate never reached the server.
When should I renew my SSL certificate?
Treat 30 days before expiry as the practical deadline for a first warning — it turns renewal into a planned task rather than an emergency. With automated renewal (Let's Encrypt/ACME), renewal typically happens 30 days out; independent monitoring catches the cases where that automation silently fails.
Is this SSL checker free and private?
Yes. It's completely free, needs no account, and performs a single live TLS handshake per check. We don't store the domains you check or the certificates we read.