SSL certificate checker
Check a site's SSL/TLS certificate: when it expires, who issued it, and whether browsers trust it.
SSL 证书检测
检测网站的 SSL/TLS 证书：什么时候到期、由谁签发、浏览器是否信任。
What the checker shows
- Expiry: The date the certificate stops being valid and the days left. Under 14 days is shown as expiring soon.
- Trust: Whether the chain the server sends leads to a trusted root and covers the name you entered. If not, the reason is shown.
- Issuer: The certificate authority that signed it, such as Let's Encrypt, Google Trust Services or DigiCert.
- Subject: The name the certificate was issued to, and the date it became valid.
Fixing common certificate problems
- Expired: Renew it with your certificate authority or ACME client (certbot, acme.sh, Caddy, your hosting panel), then reload the web server so it serves the new file.
- Missing intermediate: Serve the full chain file (fullchain.pem for Let's Encrypt), not only the site certificate. Browsers may cope, but many clients do not.
- Name mismatch: Issue a certificate that lists this name, or a wildcard that covers it. A certificate for example.com does not cover www.example.com unless it lists both.
- Self-signed: Fine for internal tests, never for a public site: replace it with one from a public certificate authority.
Never let a certificate expire again
A certificate that expires takes a site down just as surely as a crashed server. OpenUptime reads the certificate of every https monitor and alerts you 14 days ahead, then at 7, 3 and 1 day, so a failed renewal is noticed in time.
Questions
How do I check when an SSL certificate expires?
Enter the domain above. The checker connects on port 443, reads the certificate the server sends and shows its expiry date and the days left. In a browser you can also click the padlock in the address bar and open the certificate details.
What happens when a certificate expires?
Browsers show a full-page warning instead of the site, and most API clients refuse to connect. To visitors the site is down, even though the server is still running.
What does "not trusted" mean?
The certificate does not chain to a root that browsers trust, or it does not cover this name. Common causes are a self-signed certificate, a missing intermediate certificate on the server, or a certificate issued for a different domain.
How long are certificates valid?
Since March 2026 a public TLS certificate can be valid for at most 200 days. Under the CA/Browser Forum's schedule the limit falls to 100 days in March 2027 and 47 days in March 2029. Let's Encrypt certificates last 90 days by default. The shorter the lifetime, the more renewals there are that can fail.
Why did my certificate not renew?
Automatic renewal usually fails because the validation request cannot reach the server (a firewall, a changed DNS record, a proxy in front), because of rate limits at the certificate authority, or because the renewed certificate was issued but the server was never reloaded.
Can OpenUptime warn me before a certificate expires?
Yes. On Lite and above, OpenUptime reads the certificate of every https monitor every 6 hours and alerts when it is 14 days from expiry (or the number of days you choose, up to 90), again at 7, 3 and 1 day, when it expires or stops being trusted, and when it is renewed.
检测结果包含什么
- 到期时间: 证书失效的日期和剩余天数。少于 14 天会标为即将到期。
- 信任状态: 服务器发送的证书链是否能链接到受信任的根证书，以及是否包含你输入的域名。如果不是，会显示原因。
- 签发机构: 签发证书的证书颁发机构，例如 Let's Encrypt、Google Trust Services 或 DigiCert。
- 证书主体: 证书签发给的名称，以及开始生效的日期。
常见证书问题的处理
- 已过期: 通过证书颁发机构或 ACME 客户端（certbot、acme.sh、Caddy、主机控制面板）续期，然后重新加载 Web 服务器，让它使用新文件。
- 缺少中间证书: 配置完整的证书链文件（Let's Encrypt 的 fullchain.pem），而不只是站点证书。浏览器也许能自己补全，但很多客户端不能。
- 域名不匹配: 签发一个包含这个域名的证书，或使用能覆盖它的通配符证书。example.com 的证书不包含 www.example.com，除非两个名字都写在证书里。
- 自签名证书: 内部测试可以用，公开网站不行：请换成公共证书颁发机构签发的证书。
别再让证书过期
证书过期和服务器崩溃一样会让网站无法访问。OpenUptime 会读取每个 https 监控的证书，提前 14 天提醒你，之后在 7、3、1 天时再次提醒，让续期失败能被及时发现。
常见问题
怎么查看 SSL 证书什么时候到期？
在上方输入域名。检测工具会连接 443 端口，读取服务器发送的证书，并显示到期日期和剩余天数。在浏览器里，也可以点击地址栏的锁形图标，打开证书详情查看。
证书过期会怎样？
浏览器会显示整页警告而不是网站内容，大多数 API 客户端也会拒绝连接。对访问者来说网站就是宕机了，尽管服务器仍在运行。
“不受信任”是什么意思？
证书无法链接到浏览器信任的根证书，或者它不包含这个域名。常见原因有自签名证书、服务器缺少中间证书，或证书是为另一个域名签发的。
证书的有效期有多长？
自 2026 年 3 月起，公开 TLS 证书的有效期最长为 200 天。按照 CA/浏览器论坛的时间表，2027 年 3 月将缩短到 100 天，2029 年 3 月缩短到 47 天。Let's Encrypt 的证书默认有效期为 90 天。有效期越短，续期次数越多，出错的机会也越多。
为什么我的证书没有自动续期？
自动续期失败通常是因为：验证请求无法到达服务器（防火墙、DNS 记录改了、前面加了代理），证书颁发机构的频率限制，或者新证书已经签发但服务器没有重新加载。
OpenUptime 能在证书到期前提醒我吗？
可以。在 Lite 及以上套餐中，OpenUptime 每 6 小时读取一次每个 https 监控的证书，在距离到期 14 天时提醒（也可以自己设置，最多 90 天），之后在 7、3、1 天时再次提醒，在证书过期或不再受信任时提醒，续期后也会通知。