Free Tool
SSL & TLS Checker
Run a real TLS handshake against any domain. See the certificate's expiry and issuer, the negotiated protocol and cipher, and an A-to-F security grade. No signup needed.
How it works
Three steps, no signup.
No crawlers, no cached data. Every check is a fresh handshake with the server you name, run the moment you ask.
Enter any domain
Type a hostname and run the check. We open a connection on port 443 and begin a real TLS handshake, the same negotiation a browser makes before it trusts a site.
We negotiate a live connection
The server picks a protocol and cipher and presents its certificate. We read the issuer, the validity window, and every hostname the certificate covers.
Read the grade
You get the expiry countdown, the issuer, the negotiated TLS version and cipher, and an A-to-F grade for how strong the connection actually is.
What does this SSL checker test?
It performs a real TLS handshake with your server, then reports the certificate's validity, issuer, and expiry date, the negotiated TLS protocol version and cipher, and an overall A-to-F connection-security grade.
What is a good TLS grade?
An A means the connection negotiated a modern protocol (TLS 1.2 or 1.3) with a strong cipher and the certificate is healthy. A C or lower means something needs attention, such as a weak cipher, an outdated protocol, or a certificate problem.
Why does my certificate expiry date matter?
When a certificate expires, browsers show visitors a full-page security warning and most will leave. Certificates issued by Let's Encrypt last 90 days, so automated renewal failing silently is one of the most common causes of avoidable downtime.
How do I monitor SSL continuously?
Sentinel checks your certificates on every monitoring run and alerts you well before expiry, on your schedule. SSL monitoring is included on the free plan.
Stop checking by hand.
Sentinel watches your uptime, SSL, DNS and domains around the clock from multiple regions, and tells you the moment something needs attention.