SSL certificate checker
See when a website's certificate expires, who issued it and which names it covers.
A certificate check tells you about today. To hear about it before it becomes a browser warning, add the site as a monitor: PingRobot reads the certificate every day and reminds you before it expires, on the Free plan too.
What the result means
| Field | What to look for |
|---|---|
| Expires | The last moment the certificate is valid. Under 14 days left on an automated certificate usually means renewal is failing. |
| Issuer | The certificate authority that signed it, such as Let's Encrypt, Google Trust Services or Sectigo. A sudden change of issuer you didn't make is worth checking. |
| Covers this host | Whether the name you entered is in the certificate's list of names. If not, browsers show a name-mismatch error (NET::ERR_CERT_COMMON_NAME_INVALID). |
| Host names | Every name the certificate is valid for. *.example.com covers one level of subdomains, like www.example.com, but not example.com itself or a.b.example.com. |
| Chain | The intermediate certificates the server sends with its own. A missing intermediate works in some browsers and fails in others and in most API clients. |
Certificates are getting shorter
The CA/Browser Forum has voted to shorten the maximum lifetime of public TLS certificates in steps: 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Shorter certificates mean more renewals each year, so a renewal job that silently stops working gets noticed sooner, as an outage, unless something is watching the expiry date.
Common reasons renewal fails
- The renewal cron job or timer was removed during a server move.
- The HTTP-01 challenge can't reach
/.well-known/acme-challenge/because of a redirect, a firewall or a new CDN. - DNS moved to a new provider and the DNS-01 API credentials no longer work.
- The certificate renewed, but the web server was never reloaded, so it still serves the old one.
The last one is why it's worth checking the certificate the server actually sends, not just the files on disk.
Frequently asked questions
How does the SSL checker read the certificate?
We connect to the site on port 443 from Cloudflare's network and read the certificate the server presents during the TLS handshake. For sites behind Cloudflare we show the newest certificate recorded in public Certificate Transparency logs, which is the one Cloudflare deploys.
What happens when an SSL certificate expires?
Browsers show a full-page security warning such as NET::ERR_CERT_DATE_INVALID, most visitors leave, and API clients refuse to connect. Nothing else breaks on the server, so it is easy to miss until someone complains.
How far ahead should I renew?
Automated certificates (Let's Encrypt, Cloudflare, most hosts) renew about 30 days before expiry. If yours is still within two weeks of expiring, automatic renewal has probably failed and needs a look.
Can PingRobot warn me before my certificate expires?
Yes. HTTPS monitors check the certificate once a day and email you 14 days before it expires (you can pick 7, 14 or 30), then daily in the last three days. It's included on the Free plan.