SEO tools
SSL Checker: Certificate Validity, Issuer and Expiry
Opens a TLS connection to the host you enter and reports the certificate it presents — the issuer, the validity window, the days remaining, and the negotiated protocol version.
What this SSL checker tests
Reading the live handshake matters because a renewed certificate that was never reloaded is invisible from the control panel: the new file exists on disk while the running server keeps serving the old one until it is restarted.
- The certificate the server actually presents, not the one you believe is installed.
- Its issuer, so you can confirm it comes from the authority you expect.
- The validity window and how many days remain before expiry.
- The negotiated TLS protocol version.
- Whether the page itself is served over HTTPS without falling back.
Why an expired certificate is an SEO emergency
A browser meeting an expired or invalid certificate shows a full-page interstitial before the site loads. Almost every visitor leaves at that point, so the practical traffic loss is immediate and near-total — long before any ranking effect could register.
HTTPS is also a confirmed, if lightweight, ranking signal, and a site that fails TLS cannot be crawled normally. The urgency comes from the interstitial rather than the ranking factor, but both point the same way.
| Finding | What it means | Urgency |
|---|---|---|
| Expired | Browsers block the site with a warning | Immediate |
| Expires within 14 days | Renewal has not run or has failed | This week |
| Unexpected issuer | Possibly a proxy or a misissued certificate | Investigate |
| Old TLS version | Modern clients may refuse the connection | Plan a fix |
| Valid, 30+ days left | Healthy | None |
When renewal succeeds but the site still fails
The usual cause is that the certificate was renewed but the server never reloaded, so the process in memory continues presenting the expired file. The second most common is an incomplete chain: the leaf certificate is valid, but an intermediate is missing, so some clients trust it and others do not. Once TLS is healthy, confirm nothing else is undermining HTTPS — see mixed content and the HTTP headers checker .
- My certificate renewed but the site still shows it expired. Why?
- The web server is almost certainly still running with the old certificate loaded in memory. Reload or restart it so the renewed file is actually served.
- Does a free certificate rank worse than a paid one?
- No. Google checks that the connection is secure, not who issued the certificate or what it cost. A Let's Encrypt certificate is treated exactly like a paid one.
Read the certificate before changing the server
For a repeatable renewal path, follow the Certbot and Let’s Encrypt guide ; for a certificate request before a commercial issuance, use the OpenSSL CSR command guide . Both steps should be verified against the live result above after the server reloads.
Subject: CN=www.example.com
Issuer: Let's Encrypt R11
Valid from: 2026-08-01
Expires: 2026-10-30
Days left: 40
TLS: TLS 1.3
First confirm the hostname matches the URL you entered.
Then act on expiry, issuer and TLS only when the live
handshake disagrees with the certificate you expect.Other tools
Fetches the robots.txt file for the host you enter, reports whether it exists and whether it blocks every crawler, and reads the page-level robots directives alongside it.
Looks for the sitemap the way a crawler does — the robots.txt declaration first, then the conventional locations — then confirms it parses as XML and counts the URLs inside it.
Reads the canonical URL a page declares, then fetches that URL to confirm it resolves, is not redirected, and is not noindexed — the three ways a canonical silently becomes inert.
Parses the structured data on the page you enter, lists the schema.org types it finds, and flags blocks that fail to parse or are missing the properties their type requires.
Follows the URL you enter through every hop, reporting the status code at each step and the final destination — the detail a browser hides once the address bar settles.
Fetches the page you enter, takes a sample of the internal links it points at, and requests each one — reporting the status code that comes back instead of the colour of the link.
Checks every signal that decides whether a page is allowed into the index — the status code, robots.txt access, meta robots, the X-Robots-Tag header, and the canonical.
Queries the live DNS for the domain you enter and reports the records it publishes: the addresses it resolves to, where its mail goes, and whether the TXT records email authentication depends on are present.
Queries the registry over RDAP — the structured successor to classic WHOIS — and reports when the domain was registered, how old it is now, who the registrar is, and when the registration lapses.
Enter a domain to find when it was registered, how old it is today, when it expires, and which registrar holds it. Domain age is context for a diagnosis, not a Google ranking factor.
Requests the URL you enter and reports what the server sends back in its headers — the security headers present, the caching policy, whether the response is compressed, and which HTTP version was negotiated.