Free check, instantly on screen

SSL check: is your website's certificate in order?

An expired certificate is the first thing every visitor sees, before your homepage. This check makes a few TLS connections to your website, one normal handshake and one probe with TLS 1.0 and 1.1, and reads what a browser sees too: validity and issuer of the certificate, the hostnames on it, the TLS version and whether outdated versions are still accepted.

Your own domain only: we check the main domain after the @ of your business e-mail address. The address itself is not stored and you will not receive any mail.

One check that only reads, at the moment you press the button. Address, domain and result are not kept.

What the check does

  • Whether the certificate is valid, who issued it and how many days it has left.
  • Which hostnames the certificate covers, and which TLS version and cipher suite the server chooses.
  • Whether the server still accepts TLS 1.0 or 1.1; those versions have been deprecated since 2021 (RFC 8996).

What this check does not do

  • No grade like SSL Labs; instead what your visitor sees, with the standard alongside.
  • No full test of cipher suites, the certificate chain, OCSP or known protocol vulnerabilities.
  • Only port 443 of the domain or of www; other hostnames and ports are not tested.

Why only your own domain

The check runs on the main domain behind your business e-mail address. That is a threshold against looking up someone else's domain, in line with our acceptable use policy that you only check domains you own or are authorised to manage. The check only reads: a DNS lookup, a few connections, one page fetch, what a mail server or browser sees too.

What the result means

The certificate proves that the visitor is talking to your server and not to someone in between. An expired or wrongly issued certificate produces a browser warning, and many visitors do not click through it. Certificate lifetimes keep getting shorter: the maximum has been 200 days since March 2026 and drops in steps to 47 days in 2029; Let's Encrypt already issues 90 days. Renewal should therefore be automated.

The TLS version partly determines how strong the encryption is, together with the cipher suite. TLS 1.2 and 1.3 are the standard; TLS 1.0 and 1.1 are deprecated because of known weaknesses. A server that still accepts them lets outdated clients connect insecurely and keeps those weaknesses alive.

The certificate is one of the things visible from the outside. What else an attacker sees, from subdomains to open ports, is in what an attacker sees of your domain.

This is a single snapshot

A record that is correct today breaks at the next DNS migration; a certificate expires silently. The free security scan looks more broadly at what your domain exposes to the internet, and the knowledge base explains what a free check does and does not show.

Also check: mail records (SPF, DKIM, DMARC) · security headers

Further reading