About the SSL Certificate Checker
The SSL Certificate Checker opens a real TLS handshake to port 443 (with SNI) and reads the certificate the server actually presents: issuer, validity window, remaining days, SAN hostnames, signature algorithm, negotiated protocol and cipher, plus the full chain from leaf to root.
Days-remaining is color-coded — anything under 14 days means your auto-renewal (e.g. Let's Encrypt certbot) needs attention. Combine with the HTTP Header Checker to confirm HSTS is set once the certificate is healthy.
Enter your domain above — the checker shows the exact expiry date and remaining days, color-coded. Let's Encrypt certificates last 90 days and normally renew automatically; if the countdown drops below 14 days, your renewal automation is likely broken.
Subject Alternative Names are all hostnames a certificate is valid for — e.g. example.com plus www.example.com, or a wildcard *.example.com. If the domain you serve is missing from the SAN list, browsers show a certificate error.
A self-signed certificate is not issued by a trusted certificate authority, so browsers warn visitors. Fine for internal testing, never for a public site — free CA-issued certificates are available via Let's Encrypt.