SSL certificate checker
We make one TLS connection, read the certificate, and check expiry, trust, hostname coverage and protocol support.
Then we tell you how many days you actually have — and whether renewal is likely to be automatic.
Expiry is the boring failure that takes sites down
An expired certificate does not degrade gracefully. Every visitor gets a full-page browser interstitial telling them the site is unsafe, and most of them leave. It is the highest-consequence, lowest-difficulty outage in web operations.
Automation is not the same as working automation
Let’s Encrypt renewal is automatic until a DNS provider changes, a site moves host, or a subdomain gets added by someone who did not know about the renewal job. The certificates that expire are almost never the ones anybody is watching.
Certificate lifetimes are getting shorter
The industry is moving steadily toward shorter maximum certificate lifetimes, which makes manual renewal untenable and makes a monitored inventory the only workable answer.
Common questions
How much warning should I have?
Thirty days is the conventional first warning and fourteen is the point at which someone should be actively fixing it. Inside seven days, treat it as an incident.
What is a hostname mismatch?
The certificate is valid, but it does not list the name the visitor typed. A certificate for www.acme.com does not cover acme.com unless both are listed, and a wildcard covers exactly one level of subdomain.
Why does TLS 1.0 being enabled matter?
TLS 1.0 and 1.1 were formally deprecated in 2021 and have known weaknesses. In practice the bigger consequence for most businesses is that leaving them enabled is a standing finding on PCI and cyber-insurance questionnaires.
Monitor certificates across every client
Marchpost watches every domain you manage on a schedule, alerts you when something changes, and produces the branded report you hand to the client. $99/month, everything included.
Other free tools