API Watch

SSL certificate checker

When does it expire, who issued it, which names does it cover — and would a browser accept it?

Public HTTPS hosts. We open a connection, read the certificate and close — no page is fetched.

The four ways a certificate breaks

It expires
The one failure with a date on it. Every browser and every API client stops talking to you at the same second, and the fix takes minutes — if you knew. That is why this page's real feature is the reminder: we can email you 14, 7, 3 and 1 days before.
It does not cover the name
A certificate for example.com does not cover api.example.com unless it says so. We list every name it covers, so you can see the gap.
The chain is not trusted
Self-signed, or issued by something the client does not know, or missing an intermediate. Browsers say "not private"; your server logs usually say nothing at all.
Renewal did not reach the server
Automatic renewal that succeeds and never reloads is the classic 3 a.m. outage: the new certificate exists on disk, the old one is still being served. A check from the outside is the only one that catches it.

Related

Free uptime monitoring — and a certificate warning before it lapses, on the same monitor.

Redirect checker · HTTP status checker · CORS checker