SSL Certificate Checker

An SSL certificate (more accurately, a TLS certificate) does two things: it encrypts data sent between the visitor and your website so third parties cannot read it in transit, and it verifies your domain identity so visitors know they're connecting to the real site, not an impostor. Every modern website needs one — HTTPS is now the baseline, and browsers warn visitors about non-HTTPS sites.

It is completely free with no signup required. Results are returned in 1-2 seconds and shareable via the result URL. We do not log domains checked or store any data tied to you.

Most SSL certificates last 90 days (Let's Encrypt) or 1 year (commercial). Set a calendar reminder for 30 days before expiry — that gives you time to renew without service disruption. If you use auto-renewal (most hosting providers handle this for you), check monthly to confirm the auto-renewal is working.

The grade summarises overall certificate health: A+ for excellent (long validity remaining, modern algorithm, strong key, TLS 1.3), down to F for expired or otherwise invalid certificates. The breakdown below the grade explains exactly which factors contributed.

Renew immediately. Most hosting providers (including iWebVault) offer auto-renewing Let's Encrypt SSL certificates — log into your hosting control panel and enable AutoSSL or click "Renew" on the SSL section. Expired certificates cause browser warnings that scare visitors away.

This usually means the certificate was issued for a different domain, or you are checking a subdomain not covered by the cert. Common cause: the cert covers example.com but you checked www.example.com (or vice versa). The fix is to reissue the certificate with all required domains as Subject Alternative Names, or use a wildcard cert.

Yes. The result page shows every certificate the server presented — the leaf certificate (issued to your domain) and any intermediate CAs in the chain. Each entry includes its subject, issuer, validity window, signature algorithm and key strength.

The trusted root CA is normally not sent over the wire — your browser supplies it from its built-in root store. So showing "leaf + intermediate(s)" without a root is correct behaviour, not a missing piece. If a server sends a self-signed root, we display that too.

For deeper trust-path validation against external CA bundles, certificate transparency log lookups and protocol-level vulnerability tests, Qualys SSL Labs remains the most thorough free tool.