SSL Certificate Checker
Check that your website, webmail and email certificates are valid and trusted. We connect the way a browser does and tell you plainly what is wrong and how to fix it.
Every service
One certificate check per service. Open Details for the full result.
Certificate tools
These run in your browser. Nothing you paste here is sent to us.
Paste the text from your .crt or .pem file, including the BEGIN and END lines.
Check the names and details in a CSR before you order a certificate with it.
Paste any two of these to see whether they belong together. A certificate only installs with the private key it was made for.
How we grade
- A+Everything below is in order, and HSTS is on.
- AValid, trusted, full chain, strong key, modern TLS only.
- A-As for A, but www is not covered or http does not send visitors to https.
- BValid, but TLS 1.0 or 1.1 is still on, or it expires within 14 days.
- CValid, but the chain is incomplete, the key or signature is weak, or a weak cipher is accepted.
- FBrowsers will show a warning: expired, wrong name, untrusted, or no modern TLS.
Your results are private. We do not publish checked domains anywhere.
Fixing a certificate on our cPanel hosting
AutoSSL gives every domain on our cPanel hosting a free certificate and renews it for you. When it cannot, one of these is usually the reason.
Run AutoSSL yourself
Log in to cPanel, open SSL/TLS Status under Security and click Run AutoSSL. It takes a few minutes. Check again here when it is done.
The domain must point at our server
AutoSSL proves you own the domain by reaching it on our server. If the domain's DNS points somewhere else, or through a proxy, the certificate cannot be issued or renewed.
CAA records can block it
A CAA record lists the companies allowed to issue certificates for your domain. If you have one, it must allow letsencrypt.org or sectigo.com, the providers AutoSSL uses.
The www version shows a warning
AutoSSL only adds www to the certificate when www points at our server too. Add a CNAME or A record for www, then run AutoSSL again.
Email apps say the certificate is wrong
Your email app connects to the incoming and outgoing server names in its settings. If that name is not on the certificate, the app shows a warning. Type that server name above, choose Email (IMAP) or Email (SMTP), and check it.
