Free SSL Certificate Checker — Verify HTTPS & SSL Status

What SSL does

• Encrypts data: Passwords, credit cards, and form submissions become unreadable to attackers
• Authenticates identity: Verifies you're connecting to the real website, not a fake copy
• Enables HTTPS: The "S" in HTTPS stands for "Secure" (HTTP + SSL)

How to spot a secure site

• Padlock icon in the browser address bar
• https:// at the beginning of the URL (not http://)
• No warnings about "connection not secure"

Google uses HTTPS as a ranking signal. Since 2014, HTTPS has been a confirmed ranking factor. Not the biggest factor — but enough to matter. Between two otherwise equal sites, the HTTPS site ranks higher.

Browsers flag HTTP sites as "Not Secure." Chrome, Edge, and Safari all display a "Not Secure" warning on any site without SSL. That warning kills trust. Visitors leave.

Users expect the padlock. A 2024 survey found 85% of users abandon a checkout if they don't see the padlock icon. SSL isn't optional for ecommerce. It's table stakes.

Expired certificate

Error message: "Your connection is not private" or NET::ERR_CERT_DATE_INVALID
Why it happens: SSL certificates have expiration dates (usually 90 days to 1 year). Someone forgot to renew.
How to fix: Renew the certificate through your hosting provider or SSL vendor. Most hosts auto-renew. Check your settings.
Check with our tool: Look at "Valid To" date. If it's in the past, expired. If it's within 14 days, renew now.

Mixed content

Error message: Padlock icon with a triangle warning. The page loads over HTTPS, but some resources (images, scripts, CSS) load over HTTP.
Why it happens: Your WordPress site has http://example.com/image.jpg in the database instead of https://. Or a plugin loads an external script over HTTP.
How to fix: Update all internal links from HTTP to HTTPS. Use a "search and replace" tool. Fix external resources by finding HTTPS versions or removing them.
Check with our tool: The SSL checker shows "Certificate Valid" but your browser shows a warning. That's mixed content.

Certificate mismatch

Error message: NET::ERR_CERT_COMMON_NAME_INVALID
Why it happens: The certificate is for www.example.com, but you're visiting example.com (or vice versa). Or you bought a certificate for example.com and added blog.example.com.
How to fix: Install a wildcard certificate (*.example.com) or a multi-domain certificate (SAN). Or ensure you redirect all variants to the exact domain on the certificate.
Check with our tool: Look at "Common Name (CN)" and "Subject Alternative Names (SANs)". Does your domain match?

Untrusted issuer

Error message: NET::ERR_CERT_AUTHORITY_INVALID
Why it happens: The certificate is self-signed (not issued by a trusted certificate authority). Or the intermediate certificate is missing.
How to fix: Buy a certificate from a trusted CA (Let's Encrypt is free and trusted, also Comodo, DigiCert, GlobalSign). Install the full certificate chain including intermediates.
Check with our tool: Look at "Issuer." Recognized authorities include Let's Encrypt, DigiCert, Sectigo, GlobalSign, GoDaddy. If issuer is your own server name, it's self-signed.

Weak encryption

Error message: No explicit error, but security tools flag it. Modern browsers may show "obsolete cryptography."
Why it happens: Your server uses SHA-1 (deprecated) or RSA 1024-bit (weak). Modern standard is SHA-256 and RSA 2048-bit.
How to fix: Reissue the certificate with stronger encryption. Most free and paid CAs use 2048-bit RSA by default now.
Check with our tool: Look at "Encryption Type." RSA 2048 or higher is good. ECDSA is also fine. SHA-1 or RSA 1024 is bad.

Fix expired certificate

1. Log into your hosting control panel (cPanel, Plesk, or your host's dashboard)
2. Find the SSL/TLS section
3. Look for "Auto-renew" — enable it
4. If already expired, click "Renew" or "Reissue"
5. For Let's Encrypt, run the renewal command or wait for cron job

Fix mixed content

1. Run our SSL checker to confirm the certificate is valid
2. Use a tool like "Better Search Replace" (WordPress) or grep/sed (manual)
3. Replace all http://example.com with https://example.com
4. Update hardcoded resource URLs in your theme, plugins, and database
5. Add this to .htaccess to force HTTPS:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

Fix certificate mismatch

1. Check the Common Name (CN) on your certificate
2. Redirect all variants (example.com → www.example.com or vice versa)
3. Or buy a wildcard certificate for unlimited subdomains
4. Update your web server config (Apache, Nginx) to use the correct certificate

Fix untrusted issuer

1. Delete the self-signed certificate
2. Install Let's Encrypt free certificate (most hosts offer one-click install)
3. Or buy a DV certificate from a trusted CA ($5-50/year)
4. Install the full certificate chain, not just the domain certificate