Expiry date, days remaining, issuer and chain validity for any public domain — no account, and nothing you type here is stored.
It opens a TLS connection to the host you name, reads the certificate that host actually serves, and reports what a browser would see:
notAfter field.It is the same certificate inspection our paid TLS checks run, exposed without an account. It runs from France, one request at a time, and stores nothing: no history, no logs of what you looked up, no results kept after the response is sent.
Everyone has certificate automation now, which is exactly why certificate outages are still common. Renewal is invisible until the day it silently stops working — the ACME account got rate-limited, the HTTP-01 challenge path moved behind auth, the cron job doing the renewal is the cron job nobody noticed had stopped. In every case the certificate keeps working right up to the hour it does not, and then every browser and every API client refuses at once.
The failure is total rather than gradual. There is no degraded mode for an expired certificate: a site that was fine at 09:59 is unreachable at 10:00, and the first people to find out are your customers. Payment flows and mobile apps with certificate pinning fail hardest, because they have no "proceed anyway" button to click.
A certificate can be perfectly valid and still fail for most of the internet.
The usual cause is a missing intermediate: your server sends only the leaf, your
browser already cached the intermediate months ago and fills the gap silently,
and everyone whose browser did not — plus every curl, every API client, every
mobile app — gets a verification error.
That is why this tool reports the chain separately from the expiry date. A green expiry with an invalid chain is a live outage for some of your visitors right now, and it will not show up by loading the site in the browser you have been using all week.
Port 443 by default. You can name another with example.com:8443, and a handful
of implicit-TLS ports are supported — 465 (SMTPS), 636 (LDAPS), 853 (DNS over
TLS), 990 (FTPS), 993 (IMAPS), 995 (POP3S), 8443 and 9443.
STARTTLS ports like 25, 143 and 587 are not checked. A raw TLS handshake against them fails for protocol reasons, and reporting that as "your certificate is broken" would be wrong.
Yes, and no. There is no signup, no email box and no trial. The endpoint is rate-limited per IP so it stays available, which is the only limit on it.
No. The check is stateless: your request produces one TLS connection and one JSON response, and nothing about it is written down. Nothing is stored, so there is no history for you to browse and no history for anyone to ask us for.
Because it dials whatever you name from our infrastructure, so it will only
resolve and connect to publicly routable addresses. A name pointing at
127.0.0.1, at RFC 1918 space, or at a cloud metadata address is refused before
anything is dialled. If you need to watch an internal certificate, the answer is
a check running inside your network, not a public tool.
No — enter a domain name. SNI needs a name, certificates are issued to names, and a certificate checked without one tells you about whichever virtual host happens to answer first rather than about your site.
Your browser has a cache and a trust store shaped by every site you have visited this year. This connects fresh, from a machine that has never seen your site, which is much closer to what a new visitor or an API client experiences.
It means you are safe today. Certificates are now issued for weeks rather than years, and the industry is moving shorter still — so the interval between a manual check being reassuring and being out of date keeps shrinking. That is an argument for something that checks continuously rather than for checking more often by hand.
This page tells you the state of one certificate at one moment. It cannot tell you about the renewal that quietly stops working next month, which is the failure that actually takes sites down.
Automated TLS monitoring watches the same things on a schedule and warns you at 30, 14, 7 and 1 days before expiry — four chances to notice, the first while it is still a calendar entry rather than an incident. It also catches an invalid chain the day it appears, and watches the domain registration underneath the certificate, which is the renewal notice that went to an inbox belonging to someone who left.
Failures are confirmed from a second independent EU probe region before anyone is paged, so a resolver hiccup in one region stays a resolver hiccup. Everything runs on Scaleway with data in France, and there is a DPA available before you ask.
The free plan covers 5 checks and does not expire.