SSL Certificate Checker
Verify validity, expiry, issuer, chain, protocols and hostname coverage — instantly.
Whether the certificate is trusted right now, who issued it, when it expires and if it covers the hostname you typed.
The full leaf → intermediate → root chain the server sends, so you can spot missing intermediates and self-signed certificates.
Negotiated TLS version and cipher suite, TLS 1.2 / 1.3 support, key strength and signature algorithm — summed up in a grade.
Good to know
A few answers to the questions we hear most about certificates, trust and renewals.
An SSL certificate (technically a TLS certificate) is a small file installed on a web server that does two things: it proves the server really is the site you asked for, and it enables the encrypted HTTPS connection your browser shows with a padlock. It is issued by a certificate authority (CA) such as Let’s Encrypt, Google Trust Services or Sectigo after they verify control of the domain, and it lists the hostnames it covers, who issued it and the dates between which it is valid.
The most common reasons are: the certificate has expired; it does not cover the exact hostname you typed (for example it covers example.com but not shop.example.com); the server is missing an intermediate certificate, so browsers cannot build a chain of trust; or the certificate is self-signed rather than issued by a trusted CA. Each problem we find is listed in the issues panel together with a short fix hint. Once you have made a change on the server, use Refresh to re-run the check.
Renewing means requesting a new certificate from your CA before the current one expires and installing it on the server. On OrangeHost hosting this is automatic — AutoSSL issues and renews certificates for every domain and subdomain in your account with no action needed. Elsewhere, log in to your hosting control panel or CA account, request a renewal (most CAs allow it up to 30 days early), then replace the certificate and its chain on the server and reload the web service.
Browsers do not trust your site’s certificate directly — they trust a small set of root CAs built into the operating system. Your leaf certificate is signed by an intermediate certificate, which in turn is signed by a root. That leaf → intermediate → root sequence is the chain, and the server must send the intermediates along with the leaf. If one is missing, some browsers and most mobile apps will show a trust error even though the certificate itself is fine — our chain card shows exactly what the server sent.
Yes — free, forever. Every OrangeHost shared and reseller hosting plan includes free SSL certificates for all your domains, subdomains and add-on domains, issued and renewed automatically by AutoSSL. HTTPS is enabled out of the box, so your visitors see the padlock and your site gets the SEO and security benefits with zero configuration and no renewal reminders to worry about.