Check any SSL certificate — from your browser or your terminal
Free SSL/TLS checker, certificate tools, error fixes and expiry monitoring. Try curl ssl.sh/example.com.
Try: github.com · letsencrypt.org · expired.badssl.com
$ curl ssl.sh/example.com
example.com:443 ✔ valid TLS 1.3
issuer Example CA
expires in 64 days
chain complete · 3 SCTs
$ curl ssl.sh/example.com/days
64
Free SSL tools
See all →Certificate lifetimes are shrinking
Maximum TLS certificate validity is now 200 days — 47 by 2029
Since March 15, 2026, publicly trusted TLS certificates can be valid for at most 200 days. The limit drops to 100 days in March 2027 and 47 days in March 2029. Manual renewal no longer scales.
See the full timeline- 398days
- 200days
- 100days
- 47days
Common SSL errors
See all →- SSL handshake failed: find the cause by client and server
- "Your connection is not private": causes and fixes by code
- Certbot "Timeout during connect (likely firewall problem)" fix
- curl: (60) SSL certificate problem: causes and fixes
- Docker x509: certificate signed by unknown authority: fix
- NET::ERR_CERT_DATE_INVALID: what it means and how to fix it
- Nginx "key values mismatch": certificate and key don't match
- Python [SSL: CERTIFICATE_VERIFY_FAILED]: causes and fixes
Install & renewal guides
See all →- acme.sh wildcard certificate with DNS API (DNS-01)
- Alibaba Cloud SSL certificate: request, validate, install
- BT Panel and aaPanel SSL: Let's Encrypt, force HTTPS, renewal
- Docker Compose: Nginx + Certbot for Let's Encrypt HTTPS
- IIS SSL certificate: import, bind HTTPS and redirect
- Nginx Let's Encrypt SSL with Certbot: install, redirect, renew
- Postfix and Dovecot TLS with Let's Encrypt certificates
- Shopify SSL certificate: DNS, CAA, SSL pending and HTTPS fixes
Learn TLS
See all →- 47-day SSL certificates: 2026–2029 schedule and how to prepare
- How the ACME protocol works: RFC 8555, challenges and ARI
- Certificate chains explained: leaf, intermediate and root
- How TLS works: encryption, integrity and identity explained
- TLS 1.3: what changed from TLS 1.2 and how to enable it
- Automate certificate renewal before lifetimes hit 47 days
- DV vs OV vs EV certificates: what each level validates
- HSTS: Strict-Transport-Security, preload and common pitfalls
Never let a certificate expire again In development
Let's Encrypt stopped sending expiry emails in 2025. ssl.sh Monitor checks your certificates and alerts you before they expire or break.
ssl.sh Monitor is in development and not open for sign-up yet. Until then, curl ssl.sh/example.com/days prints how many days a certificate has left.
See the plans- Expiry, chain and hostname checks
- Email, Telegram, Slack, webhook alerts
- Certificate Transparency alerts for new certificates
- API and curl access
Built for developers and AI agents
Every check is available as plain text for curl, as JSON, and as an MCP server that AI assistants can call.
{
"mcpServers": {
"ssl.sh": { "url": "https://ssl.sh/mcp" }
}
}News
See all →- 200-day TLS certificate limit in force since 15 March 2026
- Ballot SC-081: TLS certificates fall to 47 days by 2029
- Chrome begins phasing out CA hierarchies not dedicated to TLS
- eMudhra intermediate CAs compromised and blocked by browsers
- Entrust distrust: Chrome, Mozilla and Apple reject new certs
- Let's Encrypt to cut certificate lifetimes from 90 to 45 days