What is an SSL certificate?
An SSL certificate (more precisely a TLS certificate) is a digital document that does two things: it authenticates a server's identity, and it enables encrypted communication between the server and the browser. When a visitor connects over HTTPS, their browser checks that the certificate is valid, unexpired, and issued by a trusted Certificate Authority (CA). Without a valid certificate, the browser shows a security warning and many users will leave.
What is an SSL certificate chain?
An SSL certificate chain (also called a certificate trust chain) is the ordered sequence of certificates that links your site's certificate back to a root Certificate Authority that the browser already trusts.
There are three types of certificate in a chain:
- End-entity certificate — the certificate issued for your domain (e.g. example.com). This is the one your server presents to visitors.
- Intermediate certificate(s) — one or more certificates issued by the root CA to an intermediate CA. CAs use intermediates so the root private key stays offline and secure.
- Root certificate — the self-signed certificate from the trusted root CA (e.g. DigiCert, Let's Encrypt ISRG Root). Browsers ship with a built-in list of trusted root certificates.
When a browser connects to your site, it walks up this chain: it verifies your end-entity certificate was signed by an intermediate, that the intermediate was signed by the root, and that the root is in its trust store. If any link is missing or invalid, the browser shows a certificate error — even if your own certificate is perfectly valid. This is why a misconfigured or incomplete certificate chain is one of the most common causes of SSL errors.
To check your certificate chain, enter your domain in the SSL checker above — it reports whether the full chain is correctly installed and trusted.
Certificate expiry
SSL certificates are issued with a fixed validity period — currently a maximum of 398 days for certificates issued by public CAs. Expired certificates cause browsers to block visitors with a security warning. The safest approach is to set up automated renewal (via Let's Encrypt / Certbot, Caddy, or your hosting provider) and add monitoring alerts to catch any renewal failures before they cause downtime.
SSL vs. TLS — what is the difference?
SSL (Secure Sockets Layer) is the original protocol, now deprecated. TLS (Transport Layer Security) is its successor and what all modern HTTPS connections actually use. The term "SSL certificate" stuck as the popular name even though the protocol underneath is TLS. When someone says "SSL", they almost always mean TLS in practice.
TLS versions
TLS 1.2 and TLS 1.3 are the current secure standards. TLS 1.0 and 1.1 are deprecated and disabled in modern browsers. TLS 1.3 offers improved performance (one fewer round trip during the handshake) and stronger security by removing legacy cipher suites. The SSL checker above reports which TLS version your server is using.
Free SSL certificates — Let's Encrypt
Let's Encrypt is a free, automated, open CA that issues 90-day TLS certificates at no cost. It is run by the Internet Security Research Group (ISRG) and is trusted by all major browsers. The short 90-day validity is intentional — it encourages automated renewal via ACME clients like Certbot, Caddy, or Traefik. When renewal automation fails silently, certificate monitoring is the only way to catch expiry before it affects users.
Frequently asked questions
How do I check SSL certificate expiration date?
Enter the domain name in the SSL checker above and click Check. The tool shows the certificate's expiry date, how many days remain, the issuer, and whether the full certificate chain is valid — no install required. You can also check in a terminal with echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates, or in Chrome by clicking the padlock icon → Connection is secure → Certificate is valid.
What causes SSL certificate errors?
The most common causes: expired certificate (renewal failed or was missed); incomplete certificate chain (intermediate certificates not installed on the server); hostname mismatch (the certificate covers a different domain than the one being accessed, e.g. missing www); self-signed certificate (not issued by a trusted CA); certificate revoked (the CA revoked it after a key compromise). The SSL checker above identifies which of these applies to your domain.
What is the difference between SSL and TLS?
SSL (Secure Sockets Layer) versions 2.0 and 3.0 are both deprecated and insecure. TLS (Transport Layer Security) is the modern replacement — TLS 1.2 and 1.3 are the current standards. In everyday use "SSL" and "SSL certificate" refer to TLS certificates; the older name just stuck. If someone tells you a site "has SSL", they mean it has a valid TLS certificate and serves HTTPS.
How long does an SSL certificate last?
Public CA-issued certificates are currently capped at 398 days (~13 months). Let's Encrypt issues 90-day certificates. Apple and Google have announced plans to shorten the maximum to 47 days by 2027, which will make automated renewal essentially mandatory. Self-signed certificates can be issued for any duration but are not trusted by browsers.