SSL Certificate Checker Online
Check SSL/TLS certificate details for any domain: expiry, issuer, SANs, and validity status.
When an SSL certificate checker is the right tool
You often want to know which certificates have been issued for a name, when they expire, and which alternative names they cover. This page is for searching the crt.sh certificate transparency logs from the browser: type a domain, click Check (or press Enter), and read up to five certificate cards. The name is sent to crt.sh; the check does not stay on this device, and it is not a live TLS handshake with the server.
If you need the addresses a name resolves to, use DNS Lookup (that tool calls dns.google).
Use cases
Seeing when logged certificates expire
Each card’s badge is Valid, Expiring (30 days or fewer left), or Expired, based on the not-after date in the log. The validity line shows the not-before and not-after dates. This is useful for a quick reminder, not as proof of what a visitor’s browser will accept today.
Reading the issuer and SAN list
The issuer is the issuer_name from crt.sh. Subject alternative names are shown as chips (up to 12, then a count of the rest). Wildcard names appear if they were in the logged certificate.
Pasting a URL instead of a bare domain
You can paste https://example.com/path; the scheme and path are stripped before the query. A port in the host is left in place, which may prevent a match, so prefer a bare hostname.
How the check works
The request is https://crt.sh/?q=…&output=json. Rows are deduplicated by not-before, not-after, and common name, then sorted so the latest not-after comes first, then trimmed to five cards. A footnote under the results states that the data comes from crt.sh. There is no copy button. While a request is in flight, the previous result is cleared.
What this tool does not do
It does not connect to port 443, validate a chain, check revocation, or report TLS protocol versions or cipher suites. It does not keep a history. For DNS, use DNS Lookup. For HTTP response headers, use the HTTP Header Inspector.
How to use SSL Certificate Checker
- Type a domain, or paste a URL. Click Check or press Enter.
- The query is sent to crt.sh. Read the certificate cards and the expiry badges.
- Treat the list as CT log data, not as a live verification of the server.
Frequently asked questions
Does this page connect to the server and inspect the live certificate?
No. It does not open a TLS connection to the host, and it does not verify the certificate the server is presenting now, the chain, or the TLS version. It queries the crt.sh certificate transparency (CT) search API. The name you enter is sent to crt.sh. Historical and leftover certificates can appear, and the live cert on the server may differ.
How is the domain sent, and what is shown?
The input is trimmed, an http:// or https:// prefix is stripped, and any path after the first / is removed. A port is not stripped. The page then requests https://crt.sh/?q=…&output=json. Certificates are deduplicated by not-before, not-after, and common name, sorted by not-after (latest first), and limited to five. Each card shows the common name, issuer, a validity range, and subject alternative names.
What do Valid, Expiring, and Expired mean?
Days remaining are computed in the browser from the not-after date: floor of the millisecond difference divided by one day. Expired means that value is negative. Expiring means 0 to 30 days inclusive remain. Otherwise the badge is Valid, with the day count. Dates are formatted in the en-US short-month style, regardless of the site language. The boundary of a day depends on this device’s clock and time zone.
How are SANs listed?
They come from the name_value field in the crt.sh row, split on newlines, trimmed, and de-duplicated. Up to 12 names are shown as chips; if there are more, a “+N more” note is added (that phrase is always in English).
What errors might I see?
If crt.sh returns a non-OK HTTP status, the page shows “crt.sh returned” and the status code. An empty or non-array payload is “No certificates found for this domain.” Other failures, including a network or JSON error, may appear as the error message or “Failed to fetch certificate data.” Lookups are not live: you click Check or press Enter.
Is the query private?
DiffCheck does not store the lookup, but crt.sh receives the name, and the request comes from your network address. Do not look up names you would not be comfortable sharing with that service. Availability and the contents of the log depend on crt.sh, not on a live handshake from this page.
Related tools and guides
References
- crt.sh is a Certificate Transparency log search service. This page uses its JSON output, not a TLS probe of the origin server.
- Certificate Transparency describes why issued certificates appear in public logs, including ones that may no longer be served.