SSL Certificate Security Checker

Check SSL certificate security details free online using the public crt.sh certificate transparency log. See expiry, issuer, and certificate history instantly.

How to Use This Tool

Enter a domainAdd any domain name you want to check

Click Check CertificatePublic certificate transparency logs are queried

Review expiry and historySee validity status and recent certificate rotation pattern

Certificate Transparency Makes This Genuinely Public Data

Since 2018, every publicly trusted SSL certificate browsers accept must be logged in a Certificate Transparency log -- an append-only, publicly auditable record that exists specifically so anyone, including security researchers and domain owners themselves, can verify which certificates have been issued for any domain. crt.sh is a search interface over these logs, making this genuinely public regulatory data, not anything scraped or unofficial.

This tool queries that public log and surfaces the most relevant facts: current validity status, days until expiry, issuing certificate authority, and recent certificate history for the domain.

Why Certificate Expiry Causes Real Business Damage

An expired SSL certificate triggers a full-page security warning in every modern browser, and the overwhelming majority of visitors will not click through past it. Unlike a slow page or a minor bug, this is binary -- the site is effectively inaccessible to normal traffic until the certificate is renewed, which is why monitoring expiry dates (or fully automating renewal) is treated as a critical operational concern.

What Certificate History Reveals

A domain that renews certificates cleanly before each expiry, consistently using the same certificate authority, suggests stable operational practices. Gaps in coverage, frequent authority switching, or certificates issued by unexpected authorities can be worth investigating further, sometimes as an early indicator of configuration problems or, in rare cases, unauthorized certificate issuance.

Frequently Asked Questions

crt.sh is a public certificate transparency log search tool. Certificate Transparency is an industry-wide initiative where all publicly trusted SSL certificates are logged in append-only public ledgers, a requirement enforced by major browsers since 2018. This means crt.sh isn't scraping data -- it's querying genuinely public, authoritative records that certificate authorities are required to publish.

Seeing how frequently a domain rotates certificates, whether past certificates expired without renewal gaps, and which certificate authorities have issued for the domain helps spot patterns -- a domain with chaotic certificate history might indicate poor operational practices, while clean rotation patterns suggest good certificate management.

Browsers display a prominent security warning, and most users will not proceed past it. This isn't just an inconvenience -- it can immediately tank traffic and conversions for a business, which is why expiry monitoring matters even though renewal can usually be automated.

Not exactly. This shows certificate issuance and expiry data from public logs. It does not perform a live TLS handshake check or verify the current server configuration is using the certificate correctly, which is a different, more involved diagnostic.

Yes -- certificate transparency logs are public by design specifically so anyone can audit which certificates have been issued for any domain, which is itself a security feature that helps detect unauthorized or fraudulently issued certificates.