SSL Certificate Checker: How to Find Expired, Invalid and Mismatched Certificates

An SSL certificate checker helps you inspect the TLS certificate presented by a website or online service. It can reveal expiration dates, hostname coverage, certificate issuer information, and trust-chain problems.

DNS may point to the correct server while the website still displays a security warning. This often happens after a website migration, CDN change, load balancer update, hosting move, or certificate renewal failure.

Check an SSL certificate with DNSCheckers.com.

What Does an SSL Certificate Checker Test?

Depending on the tool, an SSL certificate check may display:

• Certificate subject
• Common name
• Subject Alternative Names
• Certificate issuer
• Issue date
• Expiration date
• Serial number
• Signature algorithm
• Certificate chain
• Hostname match

How to Check an SSL Certificate

1. Enter the domain or hostname.
2. Use the hostname visitors actually open.
3. Start the SSL certificate check.
4. Review the validity dates.
5. Confirm that the hostname is covered.
6. Inspect the issuer and certificate chain.

Check both the root domain and important subdomains:

example.com
www.example.com
mail.example.com
portal.example.com

A certificate valid for one hostname is not automatically valid for every other hostname.

Expired SSL Certificate

An expired certificate can cause browsers and applications to display warnings or reject the connection.

Common causes include:

• Automatic renewal failed
• DNS validation failed
• The renewed certificate was not installed
• The web server was not restarted or reloaded
• A load balancer still serves the old certificate
• A forgotten subdomain uses a separate certificate

Certificate Name Mismatch

A hostname mismatch occurs when the requested domain is not included in the certificate's valid names.

For example, a certificate may cover:

example.com

but not:

www.example.com

unless www.example.com is also included in the certificate's Subject Alternative Names or covered by a suitable wildcard.

Name mismatch errors commonly occur after:

• Pointing DNS to the wrong server
• Using a shared hosting default certificate
• Moving behind a load balancer
• Changing CDN configuration
• Forgetting to include a subdomain
• Installing the certificate on only one server in a cluster

Incomplete Certificate Chain

A server normally presents the website certificate together with the required intermediate certificates. If the intermediate chain is missing or incorrect, some clients may fail to build a trusted path.

This problem may affect older devices, API clients, mobile applications, or systems with different trust stores even when the website appears normal in a modern browser.

Wrong Certificate After a DNS Change

After changing an A, AAAA, or CNAME record, visitors may reach a new server that does not have the correct certificate installed.

Check the following:

• DNS points to the intended server
• The correct virtual host is configured
• The certificate includes the requested hostname
• The private key matches the certificate
• The load balancer or reverse proxy uses the new certificate
• IPv4 and IPv6 reach the same configured service

SSL Certificate vs DNS

DNS and SSL perform different functions:

• DNS directs the hostname toward a server or service.
• SSL/TLS authenticates the hostname and protects the connection.

A correct DNS result does not prove that the certificate is valid. A valid certificate also does not prove that DNS points to the intended application.

SSL Troubleshooting Checklist

1. Run an A and AAAA record lookup.
2. Check the CNAME target if one is used.
3. Confirm that every IP address serves the same certificate.
4. Check the certificate expiration date.
5. Review the Subject Alternative Names.
6. Inspect the intermediate certificate chain.
7. Test the root domain and www separately.
8. Test important API and mail hostnames.
9. Check CDN, proxy, and load balancer certificates.
10. Verify that automatic renewal is working.

Frequently Asked Questions

How can I check when an SSL certificate expires?

Enter the website hostname into an SSL certificate checker and review the valid-from and valid-until dates.

Why does my browser show a different certificate?

DNS may point to a different server, a CDN may terminate TLS, a proxy may present another certificate, or one server in a cluster may be misconfigured.

Does a wildcard certificate cover the root domain?

A wildcard such as *.example.com covers many first-level subdomains, but it does not automatically guarantee coverage for example.com unless the root domain is also included.

Can an SSL certificate be valid but still show a warning?

Yes. The certificate may be within its validity period but have a hostname mismatch, missing intermediate chain, untrusted issuer, revoked status, or mixed-content problem.

Conclusion

An SSL certificate checker provides a fast way to identify expired certificates, hostname mismatches, missing chain certificates, and configuration problems after DNS or hosting changes.

Use the DNSCheckers.com SSL Certificate Checker to inspect certificate information and confirm that your website presents the correct certificate.