SSL Certificate Checker
Is the padlock real? Enter a website and we'll check its security certificate the way a browser does: whether it's trusted, which names it covers, when it runs out, and whether the server is set up so phones and apps accept it too.
Try , , or a broken one: .
Want to lock down who can issue certificates? DNS Lookup shows the domain's certificate rules (CAA), which list the only companies allowed to issue one. Open DNS Lookup → Does the site make full use of HTTPS? The Security Headers Checker shows whether it forces the secure version, blocks injected scripts, and protects its cookies. Open Headers Checker →A certificate is a website's ID card. When you visit a site over HTTPS, it shows your browser the certificate, and your browser checks three things: that a company it trusts issued it, that it's for the name in the address bar, and that it hasn't run out. If any of those fail, you get the full-page "Your connection is not private" warning.
The chain is how trust gets passed along. The site's certificate is signed by an in-between (intermediate) certificate, which is signed by a root certificate built into your device. The server has to send the in-between one. Desktop browsers can often patch a missing link, but phones, apps, and other servers usually can't, which is why a site can work on your laptop and fail everywhere else.
A padlock doesn't mean a site is honest. Certificates are free and automatic now, and scam sites have them too. It only means the connection is private and you're talking to whoever controls that domain.
SSL is the old name; today's connections use TLS, but everyone still says SSL. Free use is limited to 50 checks per day.
