Free SSL certificate and HTTPS check

What an SSL certificate and HTTPS are

A certificate (strictly speaking TLS today, but the name SSL stuck) confirms that the browser is talking to the real server of your domain and enables an encrypted HTTPS connection. For this to work, the certificate must be valid and issued for the right name, and the server must send the full certificate chain up to a trusted authority and use current versions of the TLS protocol.

Why it matters for a small business

When a certificate expires, the browser shows a full-page warning instead of your website, and most visitors leave. Forms and logins without HTTPS send data in plain text. Certificate lifetimes are also getting shorter: certificates issued from 15 March 2026 are valid for at most 200 days, from 2027 it will be 100 and from 2029 only 47 days. Renewing by hand once a year is no longer enough.

Common SSL certificate mistakes

Missing intermediate certificate. A computer opens the website, but some phones, payment gateways or other programs refuse the connection.
Not every variant ends up on HTTPS. The address with or without www, or with http://, stays unencrypted or ends in an error.
The server still supports TLS 1.0 and 1.1, which have been deprecated since 2021 (RFC 8996). TLS 1.2 and 1.3 are enough.
HSTS is missing. The Strict-Transport-Security header tells the browser to open the website over HTTPS only. Without it, an attacker on the network can intercept any visit that starts at an address without https and keep it unencrypted. Only an entry in the HSTS preload list protects even the very first visit.
Mixed content: a page on HTTPS loads images or scripts over http://.

What WebMeter checks, and what it doesn't

WebMeter makes the same connection as a browser and checks the certificate's validity and upcoming expiry, name match, chain and trust, key strength, revocation via OCSP (if the certificate lists it), supported TLS versions, weak ciphers, and whether the reachable variants with and without www redirect to HTTPS. It flags mixed content, missing HSTS and certificates that are probably renewed by hand.

The check is passive: it does not test for vulnerabilities or try every cipher, it tests one IP address of the server and only the domain you enter, not your mail server or other subdomains. Let's Encrypt certificates have not listed an OCSP address since 2025, and WebMeter does not read certificate revocation lists (CRLs). The grade estimate based on the SSL Labs methodology is indicative.

FAQ about SSL certificates

How often does an SSL certificate need renewing?

It depends on the issue date. Certificates issued from 15 March 2026 are valid for at most 200 days; from March 2027 the limit drops to 100 days and from March 2029 to just 47. That is why automatic renewal via the ACME protocol pays off, and most hosting providers now offer it free of charge.

Isn't the padlock in the browser enough?

The padlock only tells you the connection is encrypted and the browser accepted the certificate. It does not tell you whether the server still supports outdated TLS versions, whether every variant of your address ends up on HTTPS, or when the certificate expires.

Is a paid certificate better than a free one from Let's Encrypt?

Not for encryption: browsers trust both equally and encrypt the same way. Paid OV and EV certificates also verify your company, but browsers no longer highlight this in the address bar.

Does WebMeter also check the mail server's certificate?

No. It checks the certificate and HTTPS setup of the domain you enter, and whether its reachable variants with and without www and with http:// redirect to HTTPS. It does not check your mail server, other subdomains or internal systems.