SSL Certificate Checker
Check a domain's SSL certificate the way a browser sees it: when it expires, which names it covers, who issued it, whether the chain is complete, and which TLS versions the server still accepts.
SSL.com TLS Issuing ECC CA R2 · SSL Corporation
Checked directly from the ipku.in server: one TLS connection for the certificate, plus one per TLS version. The chain is judged against Mozilla's root CA list. A warning shows 14 days before expiry.
- ✓ValidityValid for 147 more days.
- ✓Domain nameThe certificate covers security.cloudflare-dns.com.
- ✓Certificate chainComplete and trusted, up to the SSL.com TLS ECC Root CA 2022 root.
- ✓TLS versionsAccepts TLS 1.3, TLS 1.2.
- name
- security.cloudflare-dns.com · Cloudflare, Inc.
- SAN (6)
- security.cloudflare-dns.com*.security.cloudflare-dns.com1.0.0.21.1.1.22606:4700:4700::10022606:4700:4700::1112
- issuer
- SSL.com TLS Issuing ECC CA R2 · SSL Corporation
- valid from
- Sep 23, 2026
- valid until
- Apr 9, 2027
- serial
- 0FB25B53EED0D6C104EF46E7AA3E6C17
- sha-256
- D7:76:EB:F9:29:73:A1:F2:C0:AC:4F:E6:6E:4C:E2:B1:24:C1:2B:F8:38:9A:61:52:16:75:75:DB:B5:69:4F:8B
- ●security.cloudflare-dns.comcertificate · valid until Apr 9, 2027
- └SSL.com TLS Issuing ECC CA R2intermediate · valid until Oct 18, 2032
- └SSL.com TLS ECC Root CA 2022intermediate · valid until Dec 31, 2028
- ip
- 1.0.0.2
- protocol
- TLS 1.3
- cipher
- TLS_AES_128_GCM_SHA256
- alpn
- h2
- TLS 1.3accepted
- TLS 1.2accepted
- TLS 1.1refused
- TLS 1.0refused
SSL certificates, briefly.
What is an SSL certificate?
▼
An SSL (strictly, TLS) certificate proves that the server really belongs to the domain and encrypts the connection between browser and server. Without a valid one, browsers show a "Not secure" warning and visitors may leave.
Why does the browser say "not secure" when SSL is installed?
▼
The usual causes: the certificate has expired, it doesn't cover the name being opened (say, example.com but not www.example.com), the intermediate chain isn't installed, or the page loads images and scripts over http:// (mixed content). The first three show up in this check.
What does an incomplete chain mean?
▼
CAs issue certificates through an intermediate certificate, and the server has to send that intermediate along with the domain certificate. Desktop browsers can sometimes fill the gap themselves, but Android, curl, and many apps cannot, and refuse the connection. The fix is to install the CA bundle from the issuer together with the certificate.
How long is a Let’s Encrypt certificate valid?
▼
Let's Encrypt certificates are valid for 90 days and usually renew automatically about 30 days before they run out. If this check shows 14 days or fewer left, automatic renewal has probably failed, for example because the domain's DNS no longer points at the server.
Can I check ports other than 443?
▼
Yes. Pick the port next to the domain field: 465 (SMTPS), 993 (IMAPS), and 995 (POP3S) for mail servers, or 2083, 2087, and 2096 for cPanel, WHM, and webmail. Ports that use STARTTLS, like 25 and 587, are not supported yet.
Can I use it from a terminal?
▼
Yes. curl 'ipku.in/en/tools/ssl-check?q=example.com' returns the check as plain text, and /api/ssl/example.com returns JSON. Add &port=993 or ?port=993 for another port.