SSL CheckerCertificate Expiry, Issuer, TLS Version

An expired certificate takes a secure site down for every visitor at once. Kwebby's SSL Checker looks at the certificate of any domain and shows its status, expiry date, days remaining, issuer, chain trust, hostname match, TLS version, cipher suite and every Subject Alternative Name. Use it to catch a renewal before it fails and to confirm a new install worked.

This guide explains each field, what TLS versions mean and what Google says about HTTPS today.

Key Takeaways

• Kwebby's SSL Checker shows certificate status, expiry date, days remaining, issuer, protocol version, cipher suite and Subject Alternative Names for any domain.
• SSL is the old name; the protocol in use today is TLS, and TLS 1.3 is the current version.
• MDN says TLS 1.0 and 1.1 should no longer be used, so an old protocol version in the result needs a fix.
• Certificate lifetimes are getting shorter. Let's Encrypt certificates last 90 days, and the CA/Browser Forum is cutting maximum validity from 398 days toward 47 days by March 2029.
• Google's page experience guidance says that beyond Core Web Vitals, other aspects such as HTTPS do not directly help a site rank higher, but visitors and browsers still expect it.
• Check expiry on a schedule, and automate renewals where you can.

What Is the Kwebby SSL Checker?

Kwebby's SSL Checker is a free tool that shows the SSL/TLS certificate details of any domain. Enter a URL and press Check. It returns the certificate status, expiry date, days remaining, issuer, protocol version, cipher suite and all Subject Alternative Names. No account is needed.

It reports what the server presents. It is a quick health check, not a full security audit.

Key Features and How It Works

Each result answers a practical question about the certificate.

Certificate Status and Expiry

The status badge reads Valid only when four checks pass: the certificate has not expired, its start date has passed, it covers the domain you entered, and its chain leads to a trusted root. Otherwise the badge names the problem: EXPIRED, NOT YET VALID, NAME MISMATCH or UNTRUSTED CHAIN. An untrusted chain usually means the server is missing an intermediate certificate. The expiry date and the days remaining tell you how long you have to renew. Check the days remaining first, because an expired certificate makes browsers warn visitors before they reach your page.

Issuer

The issuer is the Certificate Authority (CA) that signed the certificate, such as Let's Encrypt or DigiCert. A browser trusts a certificate because it trusts the CA that issued it. If the issuer is not the one you expect, find out why.

Protocol Version

The result shows the protocol version negotiated for this check. The tool offers TLS 1.2 and TLS 1.3, so a server that supports TLS 1.3 shows TLS 1.3, and a server that only supports TLS 1.0 or 1.1 fails to connect. The result does not list every version a server accepts.

SSL stands for Secure Sockets Layer, the older protocol that TLS (Transport Layer Security) replaced. People still say "SSL certificate" for what is now a TLS certificate. According to MDN's TLS guide, the current version is TLS 1.3, TLS 1.2 is still used by some sites, and TLS 1.1 and 1.0 should no longer be used.

Cipher Suite

The cipher suite is the set of algorithms that the server and browser agree on to encrypt the connection. You do not need to tune it by hand on most hosts, but it helps when a security review asks what the server uses.

Subject Alternative Names

Subject Alternative Names (SANs) list every domain name the certificate covers. Check them when you use a wildcard or a multi-domain certificate, since a missing name triggers warnings on that hostname.

Certificate Chain

The tool lists the chain the server sent, from the site certificate up through the intermediate certificates, with each issuer and expiry date.

Connection Details and Limits

The tool connects to port 443 and sends the domain name with SNI, as a browser does. It does not test other ports, OCSP stapling or HSTS. To see whether a site sends the Strict-Transport-Security header, use Get HTTP Headers.

Why SSL Certificates Matter

A valid certificate lets browsers set up an encrypted connection and confirm they are talking to the right domain. MDN notes that a certificate binds a website's keys to its domain name. Without one, data travels in the clear and browsers flag the site.

Chrome announced in 2018 that, starting with Chrome 68 in July 2018, it would mark all HTTP sites as "not secure".

What about rankings? Google announced HTTPS as a ranking signal in August 2014. Its current page experience guidance says that beyond Core Web Vitals, other page experience aspects do not directly help a site rank higher. Treat HTTPS as a baseline for trust and safety, not as a ranking trick.

Lifetimes also matter. Let's Encrypt certificates are valid for 90 days by default, and the CA/Browser Forum has set a schedule that reduces maximum certificate validity from 398 days, starting in March 2026 and reaching 47 days in March 2029. Shorter lifetimes mean more renewals, so expiry checks and automation matter more each year.

How to Use the SSL Checker

Follow these steps to check one domain.

1. Enter the URL. Type the domain or full address, such as https://yoursite.com, into the box.
2. Press Check. The tool connects to the site and reads its certificate.
3. Read the status. Confirm the badge reads Valid, and read the Hostname Match and Chain Trusted rows.
4. Check the days remaining. Note the expiry date and plan the renewal.
5. Review the issuer. Confirm it is the CA you expect.
6. Check the negotiated protocol. TLS 1.3 is current. If the check fails to connect at all, the server may only support TLS 1.0 or 1.1.
7. Scan the SANs. Make sure every hostname you serve is listed.

If a check fails, use the "Report if not working" button on the page.

Best Practices for Certificate Health

Most certificate problems are preventable. These habits keep sites online.

Automate Renewal

Use your host's auto-renew feature or an ACME client for Let's Encrypt, which recommends renewing at about 60 days for a 90 day certificate. Manual renewals fail when someone forgets.

Check Expiry on a Schedule

Check each domain you run on a regular schedule, and check again after any renewal or server change. Include subdomains, since each hostname must be covered by a certificate.

Retire Old TLS Versions

If the checker cannot connect to a site that loads in old browsers, the server may only support TLS 1.0 or 1.1. Ask your host to turn them off and enable TLS 1.2 and TLS 1.3. Common mistake: leaving old protocols on to support clients nobody can name.

Fix Redirects and Mixed Versions

After you install a certificate, make sure the http and www versions of your site redirect to your preferred HTTPS address. The WWW Redirect Checker and Get HTTP Headers help you confirm it.

Re-test After Changes

Run the checker again after you change hosts or CDNs, since the new server presents its own certificate.

Common Use Cases

• Renewal planning. Check the days remaining on every domain you manage.
• After installation. Confirm the new certificate is live and covers every hostname.
• Site migrations. Compare the certificate on the old and new server.
• Client audits. Add issuer, expiry and protocol version to a technical report.
• Domain research. Pair the certificate with the Domain Age Checker when you look at an unfamiliar site.

Related Kwebby Tools

Security and trust checks work best together. The SEO Tools group has more, and these fit next.

• Page Speed Checker tests how fast a page loads.
• Blacklist Lookup checks whether an IP address is on major DNS blacklists.
• WHOIS Checker shows the registration record of the domain.
• Get HTTP Headers shows the response headers a server sends.

Final Thoughts

A certificate check takes seconds and prevents one of the most visible kinds of downtime. Look at the days remaining, confirm the issuer and protocol version, and make sure every hostname is covered.

Check your main domain now, then set a reminder or an automatic renewal. For secure hosting and site builds, Kwebby's development services can help.