What the SSL checker looks at
Type a hostname, such as example.com or shop.example.com, and the checker reads the certificate the server sends back and shows you:
- Valid until: the expiry date and how many days are left.
- Issuer: the certificate authority that signed it.
- Subject / CN and SANs: the names the certificate covers.
- Hostname match: whether the name you typed is one of them.
- Chain valid: whether the certificate links back to a trusted root through the right intermediate certificates.
- TLS: the protocol version and cipher agreed, for example
TLSv1.3.
It's a single check, run from our server when you press the button. You get 5 free checks without an account, shared across all the UpMonix tools, and 5 more if you add your email address. Cookies need to be switched on.
How to read your results
At the top you'll see Certificate looks healthy or Issues detected. Then:
| Field | What it means | What "bad" looks like |
|---|---|---|
| Valid until | When the certificate stops being trusted | A past date, or one coming up soon with no renewal planned |
| Issuer | Who signed it | A name you don't recognise, or the same as the subject (self-signed) |
| Subject / CN, SANs | Every name it's valid for | The address people actually use (with or without www) is missing |
| Hostname match | Whether your name is covered | No |
| Chain valid | Whether the chain of trust is complete | No, often a missing intermediate |
| TLS | Protocol and cipher | TLS 1.0 or 1.1 |
If the checker can't make a verified connection at all, for example because the certificate has expired or the chain is broken, it shows TLS connection failed and some fields stay blank. Open the site in a browser and click the warning: the certificate viewer shows the exact reason.
Common SSL problems and how to fix them
Certificate expired
Browsers show a full-page warning; in Chrome it's NET::ERR_CERT_DATE_INVALID. (A wrong device clock causes the same message, so try a second device.) Renew with your host or certificate authority, install the new certificate and check again.
Name mismatch (www vs non-www)
The certificate covers example.com but visitors arrive at www.example.com, or the reverse. Chrome shows NET::ERR_CERT_COMMON_NAME_INVALID. A redirect won't fix it, because the browser checks the certificate before following any redirect. Reissue the certificate with every name you use.
Incomplete chain or missing intermediate
The site works in some browsers but fails in others, or in apps and payment integrations, because only some software fills the gap itself. Install the full chain from your certificate authority (often a "fullchain" or "CA bundle" file), not just your own certificate.
Old TLS versions
TLS 1.0 and 1.1 were formally deprecated in 2021 (RFC 8996), and current browsers no longer accept them. Turn on TLS 1.2 and 1.3 in your server, hosting panel or CDN, and turn the old versions off.
Auto-renewal failed silently
Automatic renewal works until something changes: DNS moves provider, a firewall or redirect blocks validation, or a CDN goes in front of the server. Nothing looks wrong until expiry day. Check your host's renewal log, renew manually and fix whatever blocked it.
Certificates are getting shorter
Under CA/Browser Forum Ballot SC-081v3, the longest a public TLS certificate can be valid fell from 398 to 200 days on 15 March 2026. It drops to 100 days from 15 March 2027 and 47 days from 15 March 2029. More renewals mean more chances for one to fail: here's how to prepare.
When a one-off check isn't enough
A check shows today's picture; it won't tell you next month that a renewal failed. UpMonix watches expiry, chain validity and TLS configuration and emails you before a certificate runs out, so you can renew before browsers warn your visitors.
SSL monitoring is on every plan. The Free plan is free forever for one domain, with no credit card, and includes uptime, domain expiry, DNS, MX and nameserver checks too. Paid plans add more monitors, faster checks and more alert channels: see pricing or everything UpMonix monitors.
FAQ
How often do SSL certificates expire?
Every public certificate has a fixed end date. Since 15 March 2026 the maximum allowed is 200 days, falling to 100 days in March 2027 and 47 days in March 2029, under CA/Browser Forum Ballot SC-081v3. Many providers issue shorter certificates and renew them automatically, so check your own certificate's date rather than assuming.
Why does my site show "not secure" if I have a certificate?
Usually the certificate has expired, doesn't cover the exact name in the address bar (www or non-www), or is missing an intermediate certificate. It can also happen when the page loads images or scripts over plain http. Run the checker on the exact hostname visitors use. If the certificate looks healthy, look for http:// links in the page.
Does the checker work for subdomains?
Yes. Enter any public hostname, such as shop.example.com or mail.example.com, and the checker tests the certificate that hostname presents. Each subdomain can have its own certificate or be covered by a wildcard such as *.example.com. A wildcard covers one level only, so check each subdomain your customers use.
Will UpMonix alert me before my certificate expires?
Yes. SSL monitoring is included on every UpMonix plan, including Free, which is free forever for one domain. UpMonix keeps an eye on your certificate's expiry date and chain and emails you before it runs out, so you can renew in good time. Paid plans add more alert channels.
Is this tool free?
Yes. You can run 5 checks without an account, shared across all the UpMonix tools, and add your email address to unlock 5 more. Cookies must be enabled. If you'd like the checks to run automatically, you can create a free UpMonix account for one domain.