Opservo

Free tool · no signup

SSL certificate checker

When does the certificate expire, who issued it, do browsers trust it, does it cover the domain, and is the chain complete? One check, plain answers, and the fix when something is wrong.

We open one TLS connection to port 443 and one plain HTTP request to port 80, nothing else. Public domains only; each domain is checked at most once every 10 minutes.

Connect a server to watch this all the time

This is one check, right now. Opservo watches every certificate it knows about, on every monitored domain and every nginx or Apache vhost on your servers, and alerts you weeks before expiry and the moment renewal fails. Uptime and SSL monitors are free.

Connect a server — free for 2One command, about 30 seconds. Read-only by default, no inbound ports.

Questions

How do I check when an SSL certificate expires?＋

Type the domain above. The tool connects to port 443, reads the certificate the server presents and shows the expiry date, the days left, the issuer and whether browsers trust it. On your own server the same answer comes from: echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates.

What does "chain incomplete" mean?＋

The server sent only its own certificate, not the intermediate certificate that links it to a trusted root. Browsers often fetch the missing piece themselves, but curl, Android, Java and many API clients refuse the connection. Serve the full chain (for certbot, fullchain.pem instead of cert.pem).

The certificate is valid but the check says it does not cover the domain＋

The certificate was issued for other names (for example www.example.com but not example.com, or the hosting company’s default name). Browsers show a security warning for a name that is not on the certificate. Re-issue it with every name you serve, or use a wildcard.

Why does it warn about TLS 1.0 or 1.1?＋

Those versions have known weaknesses and modern browsers and PCI-DSS no longer accept them. Set the web server to TLS 1.2 and 1.3 only (nginx: ssl_protocols TLSv1.2 TLSv1.3;).

Can I get alerted before a certificate expires?＋

Yes, for free. Add the domain as an uptime monitor in Opservo and it warns you 30, 14 and 7 days before expiry and the moment the certificate becomes invalid. On a server with the agent installed, every nginx and Apache vhost’s certificate is tracked automatically.