SSL certificate
Check a domain's TLS certificate: issuer, validity and expiry.
About SSL certificate
What it is
The TLS certificate (Transport Layer Security) is what puts the padlock in the browser's address bar. It proves that you own the domain and encrypts the traffic between the visitor and the server.
Why it matters
Without a valid certificate, modern browsers show security warnings and sometimes block the page entirely. An expired certificate has the same effect and can hit you without warning if you do not monitor the expiry date.
Tips
- Automate renewal with Let's Encrypt and certbot or equivalent, it is free and takes care of itself.
- Set a reminder 30 days before the certificate expires if you do not have automatic renewal.
- Check that the entire certificate chain is correct, not just the root certificate.
Common questions
How long is a TLS certificate valid?
Since 2020 the maximum is 398 days (about 13 months). Let's Encrypt certificates are valid for 90 days and renew automatically.
What is the difference between TLS and SSL?
SSL is the older term, TLS is the modern one. Today TLS 1.2 and 1.3 are used, while SSL is obsolete and insecure.
More lookups
MX lookup
See which servers receive mail for a domain, and which provider handles it.
SPF check
Check whether a domain has an SPF record and how strictly it rejects spoofed mail.
DMARC check
See whether a domain has DMARC and which policy it uses against spoofed mail.
DKIM check
Look for DKIM signing on a domain using the most common selectors.
DNSSEC check
See whether a domain is protected with DNSSEC, that is, whether its DNS answers are signed.
TXT lookup
List all TXT records for a domain, including SPF, verifications and more.
NS lookup
See which name servers control a domain's DNS.
Blacklist check
Check whether a domain's IP address is on blacklists such as Spamhaus, Barracuda and SpamCop.
A/AAAA lookup
See which IP addresses a domain points to, both IPv4 (A) and IPv6 (AAAA).
CNAME lookup
See whether a domain is an alias that points on to another domain.
SOA lookup
See the zone's core data: primary name server, contact and serial number.
CAA lookup
See which certificate authorities are allowed to issue certificates for the domain.
Reverse DNS (PTR)
Look up which host name a domain's IP address points back to.
MTA-STS
See whether a domain requires encrypted mail delivery via MTA-STS.
TLS-RPT
See whether a domain receives reports about failed encrypted mail delivery.
BIMI
See whether a domain publishes a logo that can be shown in the recipient's inbox.
Whois
See who owns a domain, when it was registered and when it expires.
HTTP security headers
Check whether a domain's website sets important security headers.