SSL certificate checker

Checks the SSL certificate on any host: issuer, expiry, the names it covers and whether the chain is complete.

Put Ken on the rest of your outbound

Inboxes, warmup, leads and copy in one place. Ken runs these checks on every inbox it manages.

What the SSL checker does

Enter a host name and the checker connects over HTTPS and reads the certificate the server presents. It shows the issuer, the validity dates and days left, the names the certificate covers, whether it matches the host, whether the chain is complete up to a trusted root, and the TLS version the server negotiated.

How to read the result

A certificate fails if it's expired, not yet valid, issued for a different name, or signed by an authority clients don't trust. A missing intermediate certificate causes errors that appear on some devices and not others, because desktop browsers often fetch the missing piece themselves while many apps and mail servers don't.

Certificates are getting shorter-lived. Under CA/Browser Forum rules, public TLS certificates issued from March 15, 2026 can be valid for at most 200 days, dropping to 100 days in March 2027 and 47 days in March 2029. Renewal needs to be automatic.

Which hosts to check

Your website and the redirect sites on your sending domains.
Your custom tracking domain, if your sending tool uses one. Tracked links have to work over HTTPS.
mta-sts.yourdomain.com, if you publish MTA-STS. An invalid certificate there breaks the policy.
Every landing page or booking link you put in emails.

Why it matters for cold email

Links in cold email get opened by prospects, and many are scanned by security filters first. A tracking domain or landing page with an expired or mismatched certificate shows the prospect a browser warning and looks broken to a link scanner. Check those hosts after any change to DNS or to the service behind them.

Questions

How do I check if an SSL certificate is valid?

Enter the host name. The checker connects, reads the certificate and shows whether it's in date, matches the name and chains to a trusted root, plus how many days it has left.

What causes a certificate name mismatch?

The certificate doesn't list the host you visited. It may cover example.com but not www.example.com, or a tracking subdomain may point at a service whose certificate is for its own domain. Issue a certificate that includes the exact name.

How long are SSL certificates valid?

Public certificates issued since March 15, 2026 can last at most 200 days under CA/Browser Forum rules. The limit drops to 100 days in March 2027 and 47 days in March 2029.

What is a certificate chain?

The server's certificate is signed by an intermediate certificate, which is signed by a root that browsers and operating systems trust. The server should send its own certificate and the intermediates. If it leaves an intermediate out, some clients can't build the chain and show an error.

Is SSL the same as TLS?

TLS replaced SSL, and every SSL version is deprecated. RFC 8996 deprecated TLS 1.0 and 1.1 too, so servers should offer TLS 1.2 or 1.3. People still say SSL certificate out of habit, and it's the same certificate.