Free checker · 3 checks a day, more with a free account
SSL Certificate Checker
Check that your certificate is valid, trusted by every client, matches the name, and will renew before it expires.
Only test sites you own or are authorised to test.
An expired or broken certificate is the most common self-inflicted outage on the web: browsers block the page, apps and APIs refuse to connect. This checker reads the certificate from a real TLS handshake, verifies the chain exactly as the server sends it, and tells you how long you have and whether renewal is on track, before the shorter lifetimes of 2027 and 2029 make manual renewal impossible.
What it checks.
A verdict, then the evidence
One line says whether the certificate works for visitors; below it, the certificate, the chain, the connection and every finding with its fix.
Missing intermediates caught
We verify the chain exactly as the server sends it, the way curl, Android and payment gateways do, so an incomplete chain that a desktop browser papers over still shows up.
Renewal health
Lifetime, age, renew-by date, renewals a year and whether automation looks stalled: a certificate from an automated authority that is past two thirds of its life has probably failed to renew.
Ready for shorter lifetimes
Public certificates are limited to 200 days since March 2026, 100 days from March 2027 and 47 days from March 2029. We show which limit applies and when the next one starts.
Distrust radar
Chains under authorities that browsers have distrusted or are distrusting (Entrust, Chunghwa, Netlock, DigiCert's G1 root, emSign) are flagged with the date trust ends.
HSTS and the HTTP redirect
Chrome now warns before plain-HTTP pages for most users, so we check that http:// redirects to HTTPS and that HSTS is long enough.
Fixes for your platform
Renewal, full-chain, TLS 1.3, name and redirect fixes for Nginx, Apache, Cloudflare, Netlify, Vercel, Next.js and WordPress.
Share, API, watch
A share link per result, a keyless JSON API, and a Watch button that adds the site to your monitored assets.
Methodology.
Grade v1.1. We connect to https://<host>/ from our probe (US East), offering TLS 1.2 and 1.3 with the hostname as SNI, and read the certificate, the chain and the verdict from that same connection (the connection never assumes validity). A second request to http://<host>/ checks the redirect. Trust is checked against the Mozilla root store bundled with Node.js; the verdict is the browser's, so a missing intermediate is a failure even though we then rebuild the chain from the certificate's CA Issuers links and offer it for download.
From v1.1 the probe also asks the certificate's OCSP responder (or reads its CRL when it names none) whether it was revoked, without verifying the responder's signature; handshakes with up to two other IPv4 addresses of the name and once without SNI; and the Worker asks Cloudflare's resolver for the name's CAA records and whether DNSSEC validates. These are reported as findings; only a revoked certificate changes the grade. The certificates logged for the name in Certificate Transparency (from SSLMate's Cert Spotter) show a renewal that was never deployed, a key kept across renewals and authorities you may not know about.
Grades
- F expired or not yet valid; revoked (OCSP or CRL, from v1.1); RSA key under 2048 bits or EC under 256; SHA-1 or MD5 signature; or the TLS handshake failed
- T the chain does not lead to a trusted root (self-signed, unknown issuer, or a missing intermediate)
- M the certificate does not cover the hostname
- A+ a valid certificate, TLS 1.3, HSTS of at least 180 days, more than 14 days left, renewal on track, HTTP redirects to HTTPS
- A valid with TLS 1.3, without HSTS of 180 days
- A- valid, but the server negotiated TLS 1.2 (no TLS 1.3)
- B under 14 days left, renewal looks overdue, HTTP does not redirect to HTTPS, or TLS 1.1
- C under 7 days left, or TLS 1.0
A distrust-radar match caps the grade at B. Gates (F, T, M) win over everything else. The radar matches a root by its key (SHA-256 of the public key) and dates a certificate by its first Certificate Transparency log entry, as Chrome does, or by its start date when it has none.
Lifetime limits (CA/Browser Forum SC-081)
- Issued from 2029-03-15: at most 47 days
- Issued from 2027-03-15: at most 100 days
- Issued from 2026-03-15: at most 200 days
- Issued from 1970-01-01: at most 398 days
Renew-by is two thirds of the lifetime. A certificate is treated as automatically renewed when it comes from an ACME authority or lives 100 days or less; past renew-by plus three days, renewal is flagged as overdue.
Distrust radar (as of November 2026)
- Chrome (and Mozilla from 1 Dec 2024) no longer trust Entrust TLS certificates issued after 11 November 2024.
- Chrome 139+ distrusts Chunghwa Telecom certificates logged after 31 July 2025.
- Chrome 139+ distrusts Netlock certificates logged after 31 July 2025.
- Chrome removed the DigiCert Global Root CA (G1) on 15 April 2026; chains that end there need the G2 or G3 hierarchy.
- Chrome removed emSign ECC Root CA - G3 on 27 October 2026.
- Chrome 153+ does not trust certificates under emSign Root CA - G1 logged after 16 November 2026.
Certificate utilities (decoders, key matcher, CAA generator)Methodology changelog
Free JSON API.
Without a key or an account: 3 scans a day with this checker. A free key gives 60 an hour, or 600 with a work email. Every answer carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a 429 carries Retry-After. The same URL asked again within a minute returns the same scan. Tool id: ssl. An http:// address or a path is checked as https://<host>/. minGrade=A+ to F answers 422 with the full scan when the grade is lower. Badge: /api/tools/v1/badge/ssl?url=example.com (grade and days left, from the newest result of the last 7 days).
curl "https://bcdrpulse.com/api/tools/v1/ssl?url=example.com"
The answer is { id, tool, createdAt, cached, report, capture, share }: report holds the grade, findings and fixes; capture the raw probe data (every hop and header, without bodies); share the result page. A saved result: GET /api/tools/v1/result/<id>. Errors: 400 bad address, 401 a sign-up is needed, 403 an address we never scan (private or internal), 429 over the limit, 503 scanner busy. The API page has keys, badges and alerts.
Questions.
What do the T and M grades mean?
They follow SSL Labs so results compare: T means the chain does not lead to a trusted root (self-signed, unknown issuer, or a missing intermediate), M means the certificate does not cover the name you checked. F is for expired certificates, weak keys or signatures, and failed handshakes.
My browser shows a padlock but you say the chain is incomplete. Who is right?
Both. Desktop browsers fetch or cache missing intermediates, so the site looks fine on your laptop. curl, many Android versions, Java, mobile apps and payment providers do not, and they fail. Install the full chain (fullchain.pem on Let's Encrypt) and the warning goes away.
Why does renewal look overdue?
Automated clients (Let's Encrypt, Google Trust Services, ZeroSSL) renew at about two thirds of a certificate's lifetime. If the certificate is older than that and still being served, the renewal job has probably been failing quietly. Run it by hand and read its error.
Do you test cipher suites and vulnerabilities?
The quick check is one TLS handshake, offering TLS 1.2 and 1.3 like a current browser, and its grade never claims what was not tested. For every protocol and cipher and the known TLS vulnerabilities (Heartbleed, ROBOT, POODLE and more), run the deep scan from the result: it uses testssl.sh, takes 2 to 5 minutes and is free with an account, with a daily limit.
Do you check every server behind the name?
We check the address the name resolves to first and up to two of its other addresses, each with a handshake of its own, and list any that are left. A name with many servers can still have one we did not reach.
Can I call it from a script?
Yes: GET https://bcdrpulse.com/api/tools/v1/ssl?url=example.com returns the grade, the certificate, the chain and the findings as JSON. Without a key or an account: 3 a day per tool; a free key gives 60 an hour (600 with a work email).
More free checkers.
Scans come from our probe on AWS (US East by default) with the User-Agent BCDRPulseHeaders (about our scanner). We store results for 30 days so share links work, and never store page bodies. Want this checked every few minutes with alerts? Add the site as a verified asset and uptime monitoring watches it. API