SSL certificate checker

What the certificate does

The certificate is what lets a browser open a site over https://: it proves the server is the site it claims to be, and it is what the padlock stands for. It has a start date and an end date, it is issued by a certificate authority the browser trusts, and it covers a list of hostnames. If any of those fail — expired, untrusted, or for a different name — every browser shows a full-page warning instead of the site.

What Google says, and what it does not

Google prefers HTTPS: "Google prefers HTTPS pages over equivalent HTTP pages as canonical" (Google: consolidate duplicate URLs), except where there are issues such as a bad certificate. The details of the certificate itself — who issued it, how long it runs — are not something Google ranks on; they matter because a lapsed certificate takes the site down for everyone.

What this checker looks for

• Expiry. Expired, or within 14 days of it — the same thresholds as our audit.
• Trust and hostname. The chain must verify against the trust store and the certificate must cover the exact hostname.
• http to https. Plain http:// visitors should be sent to the secure address by a permanent redirect.
• Mixed content. Scripts or stylesheets loaded over http:// on a secure page are blocked by browsers, and the page can break.

We check the certificate the server presents for the hostname you type, on port 443.

Next: check the security headers, or follow the redirects.