SSL certificate checker
Check the certificate a site presents on port 443: when it expires, who issued it, whether it covers the domain and whether browsers trust its chain.
What this tool checks
DNSPeek opens a TLS connection to the site on port 443, exactly like a browser does, and reads the certificate and the chain the server sends. It reports the expiry date and days left, the issuer, the names the certificate covers, whether it matches the domain you entered, whether it chains to a root that browsers trust, the TLS version and whether HTTP/2 is offered.
How to read the result
Good means browsers will accept the certificate. Needs attention flags a certificate that expires within 14 days, an outdated TLS version or a Cloudflare Origin CA certificate, which only Cloudflare’s proxy trusts. Problem means visitors see a security warning: the certificate expired, does not cover the domain, is self-signed or its chain is incomplete.
SSL during a migration
A new server often has no certificate for your domain yet, because certificate authorities validate the domain through DNS that still points at the old server. Read how DNSPeek handles that in SSL modes, and plan the switch with the migration playbook.
Frequently asked questions
Why does my browser say the certificate is not trusted when it is valid?
Most often the server sends only its own certificate and leaves out the intermediate certificate that links it to a trusted root. Some browsers fetch the missing piece themselves, others and most command-line tools do not. Install the full chain (often called fullchain.pem) on the server.
When should I renew my certificate?
Automated certificates such as Let’s Encrypt renew about 30 days before expiry. This tool warns when fewer than 14 days are left, which usually means automatic renewal is failing.
What does “does not cover the domain” mean?
The certificate was issued for other names. For example, a certificate for www.example.com does not cover example.com unless both are listed. Reissue it with every hostname visitors use.
Can I check the certificate on a new server before switching DNS?
This tool checks the server the domain points to today. To test a new server first, open a DNSPeek preview link for the domain and the new IP: the link settings show whether the new server presents a valid certificate for your domain.
Moving a site to a new server?
See the site on the new server before you change DNS: DNSPeek gives you one HTTPS preview link that works on any device and that you can share with your team or client. No hosts file, no VPN.
Create a free preview link