LeaderboardEvery site, rankedFree toolsChecks, no sign-upAgentsYour agent fixes itDocsThe API and MCP

SSL certificate checker

Check a site’s SSL certificate the way a browser meets it: whether it is valid for the name, who issued it, the days left, the chain as sent, the TLS version, old versions still let in, and whether http:// moves to https:// with HSTS.

More checksPagesDomain and email

The answer for allbirds.com

allbirds.comValid and trusted, 66 days left

66days left, until January 7, 2027

  • ShortIt sends HSTS for 91 days. Browsers forget it after that.Raise max-age to 31536000, a year, once https is settled. The preload list asks for at least that.
  • MatchesThe certificate names allbirds.com.
  • TrustedThe chain verifies to a trusted root, ISRG Root X1.
  • ValidValid until January 7, 2027, 66 days from now. Issued October 9, 2026.
  • StrongThe key is ECDSA on P-256.
  • SoundIts issuer signed it with ECDSA with SHA-384.
  • TLS 1.3It agreed TLS 1.3 with TLS_AES_256_GCM_SHA384.
  • RefusedIt refuses TLS 1.0 and TLS 1.1, as it should.
  • Redirectshttp://allbirds.com/ moves to https:// with a 301, and reaches https://www.allbirds.com/ after 2 redirects.

The certificate

Issued to
allbirds.com
Issued by
YE1Let's Encrypt
Valid from
October 9, 2026
Valid until
January 7, 2027
Names it covers
allbirds.com
Key
ECDSA on P-256
Signature
ECDSA with SHA-384
Serial number
069BD20B00102EAEC2847B5537B25ED05C00
SHA-256 fingerprint
68:69:E1:B7:54:63:2D:B7:E0:73:0A:55:4A:F7:74:F4:DC:37:BA:D5:5C:5C:AE:AA:8E:2F:46:AE:79:8B:48:BE

The chain as sent

  1. Your certificateallbirds.comIssued by YE1, until January 7, 2027Sent
  2. IntermediateYE1Issued by Root YE, until September 2, 2028Sent
  3. IntermediateRoot YEIssued by ISRG Root X2, until September 2, 2032Sent
  4. IntermediateISRG Root X2Issued by ISRG Root X1, until September 2, 2032Sent
  5. RootISRG Root X1Issued by ISRG Root X1, until June 4, 2035In the trust store

The connection

Address
23.227.38.32
Version agreed
TLS 1.3
Cipher
TLS_AES_256_GCM_SHA384
TLS 1.0 alone
Refused
TLS 1.1 alone
Refused
http://
301 at http://allbirds.com/, then 301 at https://allbirds.com/, then 200 at https://www.allbirds.com/
HSTS
max-age=7889238

One TLS handshake from clickd’s server on port 443, the name sent as SNI and nothing sent but the handshake; TLS 1.0 and 1.1 are tried the same way, each on its own. The chain is checked against Mozilla’s roots as Node.js ships them, close to what browsers trust. A root at the end of the chain may come from that store rather than the server, which need not send it. Then one request each to http:// and https:// for the redirect and HSTS. Valid and trusted says the connection is sound, not that the site is safe.

That was allbirds.com’s certificate.clickd reads the site’s first 100 pages against one rulebook and ranks every fix by what it is worth. Free, about a minute.
Read the whole site
A certificate in good orderExample
A 90 day certificate
  1. Day 0 to 60Issued, and in use
  2. Day 60 to 90Renewed here, before it expires
The chain a browser checks
  1. example.comIts own certificate, sent by the server
  2. IntermediateSent by the server with it
  3. RootAlready trusted, kept by the browser

Renewal runs on its own with a month to spare, and the server sends the intermediate, so a crawler that never fetches one still trusts the chain.

What does it check?

No rule in the rulebook covers this, so here is what it reads.

  1. Whether the certificate is valid for the name, and who issued it
  2. When it expires, and how many days are left
  3. Whether the chain is whole, so every browser and crawler trusts it
  4. The TLS version the server offers

Questions

What happens when a certificate expires?

Browsers show a warning in place of the page, and crawlers stop reading it.

Does https help a site rank?

Google counts it as a small signal. A site without it is marked not secure in every browser.

Why does my certificate work in one browser but not another?

Usually an intermediate certificate is missing from the chain. Some browsers fetch it themselves, and many crawlers do not.

The whole site

One page is one part. A read checks every page against the whole rulebook and says what to fix first.

See allbirds.com’s report