Check if a domain's SSL certificate is valid and accessible over HTTPS.
An SSL/TLS certificate is a digital document that binds a cryptographic key to an organization's identity. When installed on a web server, it activates the HTTPS protocol, enabling secure encrypted connections between the server and web browsers.
The certificate system relies on a chain of trust. Certificate Authorities (CAs) like Let's Encrypt, DigiCert, and Sectigo verify domain ownership before issuing certificates. Browsers maintain a list of trusted CAs and validate certificates against this list during the TLS handshake. If the certificate is expired, self-signed, or issued by an untrusted CA, the browser displays a security warning.
Modern TLS certificates typically use RSA 2048-bit or ECDSA P-256 keys for authentication and AES-256-GCM for data encryption. The TLS 1.3 handshake completes in just one round trip (1-RTT), or even zero round trips (0-RTT) for resumed connections, making HTTPS nearly as fast as unencrypted HTTP.
SSL certificates encrypt the connection between your users and your website. Without a valid SSL certificate, browsers will show security warnings that scare away visitors and search engines will penalize your rankings.
Expired or misconfigured SSL certificates are a common cause of outages. Your site might be running fine, but if your SSL cert expires, browsers will block access entirely. This is why automated SSL monitoring is critical for production systems.
| Type | Validation | Use Case |
|---|---|---|
| DV (Domain Validated) | Domain ownership only | Blogs, personal sites, APIs |
| OV (Org Validated) | Domain + organization | Business sites, SaaS |
| EV (Extended Validation) | Full legal entity verification | Banking, e-commerce |
| Wildcard (*.domain.com) | Covers all subdomains | Multi-subdomain apps |
# Check SSL certificate details
openssl s_client -connect example.com:443 -servername example.com \
/dev/null | openssl x509 -noout -dates -subject -issuer
# Check expiry date only
echo | openssl s_client -connect example.com:443 2>/dev/null \
| openssl x509 -noout -enddate
# Check days until expiry
EXPIRY=$(echo | openssl s_client -connect example.com:443 2>/dev/null \
| openssl x509 -noout -enddate | cut -d= -f2)
echo $(( ($(date -d "$EXPIRY" +%s) - $(date +%s)) / 86400 )) daysimport ssl
import socket
from datetime import datetime
def check_ssl(domain, port=443):
ctx = ssl.create_default_context()
with ctx.wrap_socket(socket.socket(), server_hostname=domain) as s:
s.settimeout(10)
s.connect((domain, port))
cert = s.getpeercert()
expiry = datetime.strptime(cert['notAfter'], '%b %d %H:%M:%S %Y %Z')
days_left = (expiry - datetime.utcnow()).days
return {
'subject': dict(x[0] for x in cert['subject']),
'issuer': dict(x[0] for x in cert['issuer']),
'expires': expiry.isoformat(),
'days_left': days_left,
}
print(check_ssl('uptimesignal.io'))# Check SSL and show certificate info
curl -vI https://example.com 2>&1 | grep -A 6 'Server certificate'
# Fail on SSL errors (useful in CI/CD)
curl --fail --ssl-reqd https://api.example.com/health
# Check with specific TLS version
curl --tlsv1.3 -I https://example.comssl_certificate file. In Apache, use the SSLCertificateChainFile directive.
UptimeSignal monitors SSL certificates on every check and alerts you 14 days before expiry. Never get caught by a surprise certificate outage.
Start monitoring free →