SSL Checker Online
An SSL checker reads the certificate a hostname presents on port 443 and reports its issuer, validity dates, days until expiry, the names it covers and the cipher. Enter a domain above to run it. Expired certificates and name mismatches cause most browser warnings; check the certificate chain with the OpenSSL command below.
For site owners and developers who see a padlock warning, or want to confirm a certificate renewed before it expires.
needed
- Price
- Free
- Signup
- None
- Built by
- WebJi®
- Support
- 24/7 email
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Live SSL certificate check
Live checkA red expiry or a domain mismatch is the whole story behind most browser padlock warnings. Hosting with us? AutoSSL on WebJi® plans renews Let’s Encrypt certificates for you.
What the SSL checker reports for a hostname
The WebJi® SSL checker connects to the hostname on port 443 and reads the certificate it presents: subject, issuer, validity dates, days left, the names it covers and the cipher negotiated. It reports what the server sends; it does not decide whether a browser will trust it.
| Field | What it is | What to look for |
|---|---|---|
| Days until expiry | Days between today and the certificate's not-after date | Under 15 days with no renewal planned is a warning; zero or below is an outage |
| Valid from / Valid to | The not-before and not-after dates | A future "valid from" means the clock or the certificate is wrong |
| Issuer | The certificate authority that signed it | Let's Encrypt on AutoSSL; Sectigo on a paid WebJi® certificate |
| Subject (CN) and SAN names | Every hostname the certificate is valid for | Both yourdomain.in and www.yourdomain.in should appear |
| Covers domain | Whether the name you typed is in the certificate | "NO" is a name mismatch — browsers will warn |
| Cipher | The encryption suite agreed for this connection | Modern suites (AES-GCM, ChaCha20) are what you want |
SSL check failures and the fix for each
Three findings cause almost every padlock warning: an expired certificate, a name the certificate does not cover, and a chain sent without its intermediate certificates. Fix the one the check names, then run it again until every line reads clean.
| Finding | What it means | Fix |
|---|---|---|
| EXPIRED | The not-after date has passed; browsers show a full-page warning | Renew or reissue now, then automate — AutoSSL on WebJi® hosting renews Let's Encrypt for you |
| NAME MISMATCH | The hostname is not in the SAN list — www versus the bare domain is the classic case | Reissue covering every hostname; paid certificates include both www and non-www |
| INCOMPLETE CHAIN | The server sends the leaf certificate without the intermediates; phones and strict clients fail | Install the certificate together with the CA bundle — cPanel's SSL install has a field for each |
| Mixed content | The certificate is fine but the page loads images or scripts over http:// | Change those asset URLs to https://; this is not a certificate fault |
A problem that survives a fresh reissue usually has another cause, such as a CDN or proxy serving its own certificate; the SSL not working guide walks those cases down.
How to check the SSL certificate chain from the command line
Because this checker reads only the certificate itself, verify the chain with OpenSSL, which shows every certificate the server sends and whether it verifies. Run it from any Linux or macOS terminal, or from Git Bash on Windows.
openssl s_client -connect yourdomain.in:443 -servername yourdomain.in -showcerts </dev/null- Certificate chain: lines numbered 0, 1 (and sometimes 2) mean the intermediates are being sent; only a line 0 means the chain is incomplete.
- Verify return code: 0 (ok): the chain verifies against the system's trusted roots.
- -servername: keep it — without SNI a shared server may answer with a different site's certificate.
To print only the dates, pipe the output through openssl x509 -noout -dates.
How long an SSL certificate lasts, and why expiry checks matter more each year
Let's Encrypt certificates last 90 days, and since 15 March 2026 no publicly trusted certificate can be issued for more than 200 days under the CA/Browser Forum's ballot SC-081v3. The limit falls to 100 days in March 2027 and to 47 days in 2029, so manual renewal is becoming impractical.
A paid certificate bought for a year can therefore need reissuing within that year; the date this checker shows is the certificate's own expiry, not the end of what you paid for. On WebJi® hosting, AutoSSL handles Let's Encrypt renewal automatically, and the SSL certificate page explains how a paid certificate is reissued and reinstalled.
SSL certificate prices at WebJi® after a failed check
Free Let's Encrypt SSL is included with all WebJi® hosting plans; a paid Sectigo Positive SSL costs ₹1,800 a year and the Positive SSL Wildcard ₹7,500 a year, before 18% GST. Most sites that fail a check need a renewal or a reinstall, not a new purchase.
| Certificate | Covers | Price (₹/yr) | Order |
|---|---|---|---|
| Sectigo Positive SSL | www + non-www of one domain (DV) | 1,800 | Order Now → |
| Sectigo Positive SSL Wildcard | 1 domain + all sub-domains | 7,500 | Order Now → |
| Sectigo Code Signing SSL | Code-signing certificates for software | 7,200 | Order Now → |
Prices read from WebJi® billing; 18% GST is added on the invoice. OV and multi-domain certificates are quoted at support@webji.services.
A site with many sub-domains on one name is cheaper on a wildcard SSL certificate than on separate certificates; several different domains belong on a multi-domain SSL certificate.
Getting a failed SSL check fixed
If your site is hosted with WebJi®, email the checker result to support@webji.services and the desk will reissue or reinstall the certificate. Support runs 24/7 in Hindi and English with an average first reply under 60 minutes, and certificate installation is free on WebJi® hosting.
Sites hosted elsewhere can still be moved with free migration, subject to terms and approval. Broader hardening beyond the certificate is covered by website security services.
Frequently asked questions
Why does the checker show a certificate for a different domain?
The server answered with its default certificate, usually because no certificate is installed for your hostname or DNS points to the wrong server. Check that the A record points to your host, then install or issue a certificate for that exact name.
My certificate shows as renewed, but browsers still say it expired. Why?
The new certificate was issued but not installed, or a CDN or proxy in front of the site is still serving the old one. Run this check against the hostname visitors use; if it shows the old date, reinstall on the server or update the certificate at the proxy.
Why does the checker say it could not retrieve a certificate?
Nothing answered with a certificate on port 443 within a few seconds: the site has no HTTPS set up, a firewall blocks the port, or the domain does not resolve. Confirm the domain loads over https:// in a browser, then check its DNS and the server firewall.
Does a valid certificate mean my site is safe?
No. A valid certificate proves only that the connection is encrypted to the named domain. Malware, outdated plugins and weak passwords are separate risks; a padlock on a hacked site still shows green.
Can I check a sub-domain or a mail server?
Enter any hostname that serves HTTPS on port 443, such as shop.yourdomain.in, and the checker reads its certificate. Mail ports such as 465 or 993 are not tested here; use the OpenSSL command above with that port instead.
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.