Security
SSL Check
Check your website’s SSL certificate: is it valid and trusted, when does it expire, is the certificate chain complete – and are TLS versions, HTTPS redirect and HSTS set up correctly?
- Processed on the server – Privacy
- No sign-up
- Free
Check a domain
The domain is checked exactly as you enter it (port 443). The check runs via my server and takes a few seconds.
Checks
Certificate
Certificate chain
TLS versions
HTTPS settings
Guide
How it works
- Enter the domain
Enter your website’s domain, e.g. example.com or www.example.com – you can also paste a full address. The domain is checked exactly as you enter it; it is best to check the variants with and without www separately.
- Read the result
The overall grade is shown at the top. Below it, the checklist explains each point: validity, expiry date, domain match, certificate chain, TLS versions, HTTPS redirect and HSTS.
- Fix problems
Tackle red items first – they cause warnings in browsers. Orange items are recommendations, such as disabling old TLS versions or enabling HSTS.
- Keep an eye on expiry
With “Add reminder to calendar” you get an event well before the certificate expires – in case automatic renewal ever fails.
FAQ
Frequently asked questions
What does “chain incomplete” mean?
Your server only sends its own certificate but not the certificate authority’s intermediate certificate. Some browsers fetch it themselves, but many apps, older Android devices and programs do not – they then report an error. Solution: use the “fullchain” file on the server instead of just the certificate.
Why should I disable TLS 1.0 and 1.1?
Both versions have been considered insecure for years, and all current browsers no longer support them. Offering them gains you practically no visitors but creates an attack surface. TLS 1.2 and 1.3 are recommended.
What is HSTS?
With the Strict-Transport-Security header your website tells the browser: “From now on, only open me via HTTPS.” Then nobody can intercept the first, unencrypted request. A max-age of at least 6 months is common; with one year or more you get the grade A+ here.
How is the grade calculated?
The grade is a simplified rating of its own: F for errors that trigger browser warnings (expired, wrong domain, not trusted). C for outdated protocols or weak keys, B without an HTTPS redirect or with an incomplete chain, A if everything is right, A+ additionally with HSTS. It does not replace a detailed test of all cipher suites.
What are CAA records?
With a CAA record in the DNS you specify which certificate authorities may issue certificates for your domain, e.g. only Let’s Encrypt. It is optional but makes misissuance harder.
Can I check other ports?
No, only the standard port 443 is checked. Other ports and internal addresses are not queried for security reasons.