Reading the result
How the grade is worked out
The grade follows fixed rules, the same every time, so you can predict it and see exactly what would raise it.
| Grade | When |
|---|---|
| F | A browser would warn: the certificate is expired, not yet valid, for another name, self-signed, from an unknown issuer or revoked; or it uses a key or signature browsers no longer accept. |
| C | The certificate runs out within 14 days. |
| B | TLS 1.0 or 1.1 is still accepted, there's no HSTS header, or TLS 1.3 isn't offered. Old TLS caps the grade at B, as it does on SSL Labs, and the finding is marked "Fails PCI DSS" because PCI DSS doesn't count TLS 1.0 or 1.1 as strong cryptography. |
| A | None of the above. |
| No grade | The name doesn't exist, points to a private address, or doesn't answer HTTPS. |
How it’s checked
Public information only, nothing stored
We look the name up through public DNS and only connect if it points to a public internet address. Then we connect the way a browser does: a few secure handshakes on port 443 and one ordinary request for the home page, to read its security headers. No other port is opened and nothing beyond a normal visit is attempted.
Each finding comes with a command you can paste into a terminal to see the same fact yourself. The result is kept in memory for ten minutes, so checking again doesn't repeat the work, and then discarded. Nothing is stored or linked to you.
Privacy policyQuestions
SSL checker FAQ
What does an SSL checker test?
It connects to a website the way a browser does and reads the certificate the server sends: who issued it, which names it covers, when it expires, and whether a browser would trust it. This one also tests which TLS versions the server accepts and whether HSTS and CAA are set.
How do I check when my SSL certificate expires?
Enter your website address above. The result shows the expiry date and the days left. To check from a terminal, run: openssl s_client -connect example.com:443 -servername example.com, piped into openssl x509 -noout -dates.
Why does my site say the certificate is from an unknown issuer?
Usually the server isn't sending the intermediate certificate. Browsers that fetch it themselves may look fine while other browsers, phones and apps refuse to connect. Install the full chain your certificate authority provides, often called fullchain.pem or the CA bundle.
How do I check if an SSL certificate is valid?
Enter the website address above. The checker runs the same test a browser does: the certificate must come from a public authority, cover this exact name, be within its dates, not be revoked, and arrive with its full chain. If any of those fail, the result says which one and how to fix it.
Is SSL the same as TLS?
TLS is the current name for the protocol people still call SSL. Every secure website today uses TLS 1.2 or 1.3; the old SSL versions and TLS 1.0 and 1.1 are retired.
Do I need HSTS?
HSTS (the Strict-Transport-Security header) tells browsers to always use HTTPS for your site, so a first visit can't be quietly downgraded to plain HTTP on a hostile network. Turn it on once the whole site works over HTTPS.
Can I check a site I don't own?
Yes. The check only does what any browser does when it visits a public website, so you can check your own sites, a client's, or a supplier's.