SSL Checker

An SSL checker connects to your site over HTTPS and inspects the TLS certificate it presents: whether a trusted certificate authority issued it, whether it matches the hostname, and when it expires. A missing or expired certificate makes browsers show a full-page security warning, which stops most visitors, and HTTPS is part of Google’s page experience signals.

1. Enter your domain, for example example.com.
2. The tool opens a TLS connection and reads the certificate chain.
3. Check that the certificate is trusted and that its expiry date is not close.

Passed

The certificate is trusted, matches the hostname and is valid for more than 15 days.

Needs attention

The certificate is valid but expires within 15 days.

Failed

The certificate is expired, self-signed, issued for a different hostname, or missing an intermediate certificate.

Automate renewal. Let’s Encrypt certificates are free and renewed automatically by an ACME client such as Certbot. Most hosts and CDNs, including Cloudflare, cPanel’s AutoSSL and Shopify, renew certificates for you once HTTPS is switched on.

sudo certbot --nginx -d example.com -d www.example.com
# renewal runs automatically; test it with:
sudo certbot renew --dry-run

The certificate was issued for a different name, for example example.com but not www.example.com. Reissue it to cover every hostname you serve, or redirect the uncovered hostname to one that is covered.

• Enable HTTPS on your servers (web.dev)
• Understanding page experience in Google Search results
• Let’s Encrypt documentation

• TLS certificate is valid

  Checks the origin presents a certificate that a browser trust store would accept.

  Why it matters: An untrusted, expired or mismatched certificate causes a browser security warning that blocks nearly all visitors.

  If it fails: Install a certificate from a trusted CA that matches the hostname and renew it before expiry.

  Source: developers.google.com/search/docs/crawling-indexing/https

• TLS certificate is not expiring soon

  Flags certificates that expire within 15 days.

  Why it matters: An expired certificate takes the whole site offline for users until it is renewed.

  If it fails: Automate certificate renewal (e.g. with ACME/Let’s Encrypt) so it never lapses.

  Source: letsencrypt.org/docs/

• Clear-Text Email CheckerScans the page for email addresses exposed in plain text.
• DMARC Record ToolChecks the domain publishes a valid DMARC record and reports its policy.
• HTTPS (SSL) Redirect CheckerChecks the HTTP version of the URL redirects to HTTPS.
• SPF Record ToolChecks the domain publishes an SPF record listing who may send its email.