Free tool
Which names your certificate covers, who signs it and how many days it has left.
The mail one? Add the port: mail.yourdomain.com:993 for IMAP, :995 for POP3 or :465 for SMTP.
Reference
Before letting you in, the browser checks that the certificate is for that name, that it's in date and that it's signed by someone it trusts. If any one fails, you get the warning that the connection isn't private.
The name
Every certificate comes with its list of names. yourdomain.com and www.yourdomain.com are two different names: if one is missing, anyone visiting through it will see the warning. A wildcard covers one level of subdomains, but not the bare domain.
What a certificate covers
exampleyourdomain.com
the domain
www.yourdomain.com
with www: another name
*.yourdomain.com
tienda., blog.: one level
a.b.yourdomain.com
two levels: not covered
The dates
Let's Encrypt certificates last 90 days, and the industry has agreed to lower the maximum for everyone to 47 days by 2029. Renewing them by hand no longer makes sense: what matters is that automatic renewal works.
Maximum lifetime
until 2026
paid ones, one year
15 Mar 2026
first cut
15 Mar 2027
second cut
15 Mar 2029
the final maximum
The chain
Your certificate is signed by an intermediate, and the intermediate by a root the browser already has installed. The server has to send your certificate and the intermediates. If one is missing, some browsers fetch it themselves, but other programs, such as curl or many applications, return an error.
A complete chain
yourdomain.com
your certificate: sent by the server
YR1
Let's Encrypt intermediate: also sent
Root YR
another intermediate: also sent
ISRG Root X1
the root: already in the browser
In practice, yes. SSL is the name of the original protocol, which stopped being used years ago; what encrypts your website today is TLS, usually version 1.2 or 1.3. The name “SSL certificate” has stuck out of habit, but it's the same certificate TLS uses.
Because one of the three checks fails: the certificate has expired (or isn't valid yet), it doesn't include the name you visited, or its chain doesn't reach an authority the browser trusts. The report tells you which of the three it is. If the certificate is fine and the padlock still doesn't appear, it's usually mixed content: the page loads images or scripts over http://.
The date is in the certificate itself: at the top you see the days it has left and the exact date. Free ones, such as Let's Encrypt certificates, are requested and renewed automatically by the server. On cPanel hosting AutoSSL does it, and for it to work the domain has to point to the server. Paid ones are renewed by whoever bought them, so it's worth noting the date.
No. It means the connection is encrypted and the certificate belongs to that domain. Anyone can get a free certificate in minutes, including a phishing website. The padlock protects what you send in transit, but says nothing about who is on the other side.
Yes: type the server with the port, for example mail.yourdomain.com:993 for IMAP, :995 for POP3 or :465 for SMTP. We also accept :8443. Not port 587: it starts unencrypted and upgrades to TLS with STARTTLS, and we don't check that here. To see how your email arrives, try the email test.
