Free Tool · Certificate Transparency

SSL certificate checker: issuer, expiry and fingerprints

Enter a domain to see all its valid SSL/TLS certificates from the public Certificate Transparency logs: who issued them, which names they cover, when they expire, and their SHA-256, SHA-1 and public key fingerprints.

Check a domain’s SSL certificates

Try:

What to check on a certificate

  • Days left: renew well before expiry; an expired certificate shows a full-page browser warning to every visitor.
  • Names covered: the certificate must include each name you serve, such as both example.com and www.example.com, or a wildcard like *.example.com.
  • Issuer: make sure it is the authority you use. Your DNS can restrict which ones may issue with a CAA record, visible in the DNS lookup.

Fingerprints and pinning

Apps and APIs sometimes accept only a server whose certificate matches a known fingerprint. Because certificates are renewed every few months, pinning the certificate means updating the pin each time; pinning the public key (its SHA-256 is shown for each certificate) or the issuing authority is less fragile.

To see the server software and security headers a site sends, use the website server checker.

Frequently asked questions

Where does this tool get the certificates from?

From Certificate Transparency (CT) logs, public append-only logs that every trusted certificate authority must write each certificate to before browsers accept it. The tool searches them through SSLMate’s Cert Spotter service.

Is this the certificate my server is using right now?

It lists all currently valid certificates issued for the name. Usually the newest one is the one in use. To be sure, compare the fingerprint here with the one your browser shows (padlock › Connection is secure › Certificate details).

What is a certificate fingerprint?

A hash of the whole certificate: SHA-256 is 32 bytes, SHA-1 is 20 bytes, written as hex pairs. It identifies one exact certificate and is used for certificate pinning, API allow-lists and checking you are talking to the right server.

Why do some certificates show only 90 days?

Let’s Encrypt and many others issue 90-day certificates and renew them automatically. Industry rules are shortening all public certificates further, to 47 days by 2029.

Can I find certificates I did not know about?

Yes, and that is a key use of CT logs: if a certificate appears for your domain that you did not request, someone may have mis-issued it. Report it to the issuer.

Related tools

Website Server Checker

Server software and headers

Domain Age Checker

When a domain was registered

View Page Source

HTML source of any page

Open Graph Checker

Preview a link’s share card