How to use it
- Type a domain name, not an IP address, in Domain name and press Check.
- Read the verdict, then the HTTPS and HSTS rows.
- Check Issued by, Valid from and Valid until; the note under the end date gives the certificate's total lifetime.
- Make sure your site's names appear under Names covered, and open See this certificate in the public CT log (crt.sh) for the full record.
Two checks, combined
A server function on Cloudflare can't read the certificate a website presents, so the checker combines two facts. First, it opens an HTTPS connection to the site on port 443 from Cloudflare's network. For requests to sites outside its own network, Cloudflare validates the certificate strictly (its "Full (strict)" mode), so an expired certificate, one for another name or an incomplete chain makes HTTPS show Fails.
Second, it searches the public Certificate Transparency (CT) logs through crt.sh for the newest unexpired certificate covering that exact name, or a one-level wildcard such as *.example.com for www.example.com. Chrome only accepts publicly trusted certificates that were logged this way, so the certificates of public websites are normally there.
The catch: the logs show the newest certificate issued, not necessarily the one installed. If a renewal was issued but the server still serves the old one, your browser's dates can differ from ours.
Reading the dates
The verdict turns amber at 14 days or fewer and red once the certificate has expired. Short lifetimes are normal now:
| Lifetime | Where you'll see it |
|---|---|
| 6 days | Let's Encrypt's opt-in short-lived certificates |
| 45 days | Let's Encrypt's opt-in tlsserver profile (since 13 May 2026); the default from 16 February 2028 |
| 64 days | Let's Encrypt's default from 10 February 2027 |
| 90 days | Let's Encrypt's default today |
| Longer | Other authorities; the CA/Browser Forum is cutting the maximum from 398 to 47 days between March 2026 and March 2029 |
Let's Encrypt recommends renewing when a third of the lifetime is left: 30 days before expiry for a 90-day certificate. If one of its certificates shows well under 30 days and no newer one appears, the automatic renewal has probably stopped.
When HTTPS fails
- Expired: the renewal job failed or was never set up.
- Wrong name: the certificate covers
example.combut notwww.example.com, or the reverse. Compare Names covered. - Incomplete chain: the server must send its certificate plus the intermediate certificates, as Cloudflare's error 526 page explains.
- No answer: port 443 is closed, or DNS still points to an old server.
HSTS
The HSTS row shows the Strict-Transport-Security header from the HTTPS answer. MDN explains that it makes browsers use only HTTPS for the site for max-age seconds, that browsers ignore it over plain HTTP, and that visitors can no longer click through certificate warnings. A common value is max-age=31536000; includeSubDomains; joining browser preload lists also needs preload. Turn it on only once HTTPS works on every subdomain, because a certificate problem then locks visitors out. The /http-headers-checker grades it with the other security headers.
Questions
- Why are the dates different from what my browser shows?
- We show the newest certificate in the public logs. If the server still serves an older one, your browser shows that one's dates. Restarting or reloading the web server after a renewal usually fixes it.
- Can I check an IP address or another port?
- No. The checker needs a domain name, because the logs are searched by name, and it connects on port 443 only.
- What is Certificate Transparency?
- Public, append-only logs of issued certificates. Chrome requires proof from at least two logs for certificates valid 180 days or less, and three for longer ones. Anyone can search them, for example at crt.sh.
- Why does it say HTTPS works but no certificate is in the logs?
- The certificate may come from a private authority that doesn't log, the name may only be covered by a deeper wildcard, or crt.sh may not have answered: the result says which.
- I renewed the certificate. Why does the old one still show?
- Results are cached on our side for up to about an hour, and new entries can take time to appear in the logs. Check again later.