SSL Checker
Why does the browser say “not secure”?
Enter a domain to see who the certificate is for and when it expires, whether it covers both www and the root domain, and whether the intermediate certificate is installed. If something is wrong, we tell you why and how to fix it.
SSL Errors and Fixes
Almost every SSL warning comes down to one of five causes: expiry, the name, the intermediate certificate, mixed content or redirects. Pick what you're seeing.
"Your connection is not private"
Look at the code under the warning: DATE_INVALID means the certificate has expired, COMMON_NAME_INVALID that it doesn't cover this name, and AUTHORITY_INVALID points to a self-signed certificate or a missing intermediate. The check above tells you which; the table below has the fix for each code.
The certificate has expired
For a paid certificate you need to renew it and install the new files on the server; paying alone isn't enough. With 90-day free certificates like Let's Encrypt, auto-renewal has stopped: restart it from the SSL section of your hosting panel. The check shows the expiry date and days left.
SSL certificatesError on www but not on the root domain (or vice versa)
Either the certificate doesn't cover both names, or www points to a different server. The check tests both addresses separately. Install a certificate covering both www and the root domain, and send visitors to a single address with a 301 redirect.
Works on desktop, fails on phones
It's almost always a missing intermediate certificate: desktop Chrome downloads the missing link itself, Android and Firefox don't. Add the CA bundle that came with the certificate on your server (SSLCertificateChainFile in Apache, appended to the certificate file in Nginx). The check reports this as a missing intermediate.
No padlock, or "not secure" is shown
Even with a valid certificate, the browser hides the padlock if the page loads images, scripts or forms over http:// (mixed content). Change http:// addresses in the page source to https://; in WordPress, update the site URL and the links in your content.
The site still opens over http://
The certificate is installed, but http:// doesn't redirect to https://. Turn on "Force HTTPS" in your hosting panel or add a 301 redirect on the server, then update your sitemap so search engines see the https:// address.
What Is an SSL Certificate and What Does the Check Show?
An SSL certificate encrypts the connection between a visitor's browser and your site, and proves the site really belongs to that domain. Browsers check three things: does it cover the name, is it within its validity period, and does it chain up to a trusted authority? If any one fails, visitors see a warning.
This tool runs the same three checks from our server and tells you in advance which error a browser would show. It also tests www and the root domain separately and looks for a missing intermediate certificate. It doesn't change the certificate or leave anything on the site.
- VisitorConnects over https://
- Server certificateName and validity are checked
- Certificate authorityLinked to the root via the intermediate
How to Read an SSL Certificate
CNCommon name: The certificate's main name. Browsers now rely on the SAN list; the CN remains for older compatibility.SANSubject alternative names: Every name the certificate is valid for. If the name a visitor types isn't here, they get a name-mismatch error; www and the root domain must both be listed.IssuerIssuer: The intermediate authority that signed the certificate (for example Let's Encrypt R11 or Sectigo). The browser trusts the certificate because it trusts the issuer.Not AfterExpiry date: After this date every browser shows a warning. Free certificates last 90 days; paid ones at most 200 days.ChainChain: The links from the server certificate through the intermediate to the root. If the intermediate isn't on the server, some devices can't complete the chain.
Problems can appear without the certificate changing: when you move servers, the intermediate or the www site configuration can be left behind. Run this check for both addresses after a move.
What Does the Browser's Error Mean?
Find the code on the warning page; the cause and the fix are next to it.
| Error code | Meaning | Fix |
|---|---|---|
| NET::ERR_CERT_DATE_INVALID | The certificate has expired, or the device clock is wrong | Renew the certificate; if only one device shows it, fix its clock |
| NET::ERR_CERT_COMMON_NAME_INVALID | The certificate doesn't cover this name (usually www or the root domain) | Install a certificate that covers both names |
| NET::ERR_CERT_AUTHORITY_INVALID | Self-signed, from an unknown authority, or missing its intermediate | Install a certificate from a trusted authority; add the intermediate |
| SEC_ERROR_UNKNOWN_ISSUER | In Firefox: the intermediate isn't on the server | Add the CA bundle file on the server |
| ERR_SSL_PROTOCOL_ERROR | The server isn't serving HTTPS correctly: port 443 is closed or no certificate is bound | Enable SSL in the hosting panel and bind the certificate to the site |
| Mixed content | The page loads some files over http://, so no padlock appears | Change http:// addresses on the page to https:// |
Can't see a code? Click "Advanced" or "Details" on the warning page.
Frequently Asked Questions
About SSL certificates, expiry dates and browser warnings.
-
Type your domain into the box above: the result shows the expiry date and the days left. You can also click the padlock in the address bar and open the certificate details. Free certificates expire after 90 days, so make sure auto-renewal works.
-
The browser has found a problem with the certificate: it has expired, doesn't cover this name, comes from an unrecognised authority, or is missing its intermediate. The code under the warning tells you which; the check and the error code table on this page show the fix.
-
No, but the certificate must cover both names. Most single-domain certificates include both www and the root domain; make sure both appear in your certificate request (CSR). The check tests each address separately.
-
The encryption is the same. Paid certificates last longer, offer organisation validation (OV/EV) and a warranty, and come with support; free certificates must be renewed every 90 days, and if renewal stops the site starts showing warnings.
-
The new certificate hasn't been installed on the server, or the web server hasn't been restarted. If you use several servers or a CDN, check it's installed on all of them. The check shows the certificate the server is serving right now.
-
No. Our server connects to the site like a visitor and only reads the certificate; it doesn't touch the content or leave anything behind. You can check other people's sites too.
Renew Your SSL Certificate on Time
Comodo, Sectigo, DigiCert and GeoTrust certificates start at $9.99 a year, with installation support included.