Read our full India-focused guide to this SSL Certificate Checker →
Verify HTTPS certificates — check validity, expiry, self-signed status, and certificate authority. Fake banking sites often use suspicious SSL.
An SSL grade reflects the strength of a site's encryption configuration — cipher suites, protocol versions, and certificate chain — not just whether HTTPS is present. A valid certificate can still carry a weak grade.
Certificates issued by CAs that browsers no longer trust will trigger warnings even if the certificate itself looks otherwise valid — this is worth checking separately from expiry date.
Certificate Transparency logs are public records of every SSL certificate issued for a domain, which makes it possible to detect a fraudulently issued certificate for a brand like SBI or HDFC almost as soon as it's created.
All three are legitimate, trusted Certificate Authorities — Let's Encrypt is free and widely used by small sites and phishing pages alike, so the issuer alone isn't a reliable trust signal on its own.
PhishGuard's free SSL certificate checker lets you instantly check SSL certificate website validity for any domain. Enter any URL to verify HTTPS certificate status, expiry date, issuer (CA), and self-signed detection. Our SSL checker India is trusted by thousands of users who want to check if a website HTTPS is safe in India before entering passwords, OTPs, or banking details. Phishing sites increasingly use free SSL — so HTTPS alone does not mean a site is safe. Always check the certificate issuer, domain age, and registration date together.
Also check: Phishing Link Checker · Domain Age Checker · DNS Lookup Tool
Everything you need to know about SSL certificates, HTTPS safety, and how to verify a website before entering passwords or OTP.
No. HTTPS only means the connection between your browser and the server is encrypted — it does not prove the site is legitimate. Over 80% of phishing sites now use HTTPS with free SSL certificates from Let's Encrypt. Always check the domain name itself, the certificate issuer, and the domain age before trusting any site.
Paste the website URL into PhishGuard's SSL Checker. It verifies the certificate's issuer (the Certificate Authority), the expiry date, whether it is self-signed, and whether the domain name matches the certificate. A genuine bank or government site will have an SSL certificate issued by a trusted CA like DigiCert, Sectigo, or GlobalSign — not Let's Encrypt.
An expired SSL certificate on a banking site like SBI, HDFC, or ICICI is a serious red flag. Legitimate Indian banks renew SSL certificates well before expiry. If you see an expired certificate on a page claiming to be a bank, it is almost certainly a phishing site. Do not enter any OTP, PIN, or Aadhaar number.
A self-signed SSL certificate is created by the website owner themselves rather than a trusted Certificate Authority. Browsers show a security warning for self-signed certificates. Phishing sites often use self-signed certificates because they are free and instant to generate. PhishGuard flags self-signed certificates as a high-risk signal automatically.
Domain Validation (DV) certificates only verify that the applicant owns the domain — not who they are. Let's Encrypt issues DV certificates for free, which is why phishing sites use them. Organisation Validation (OV) verifies the business identity. Extended Validation (EV) is the highest level and verifies the legal entity — real Indian banks use EV or OV certificates.
Enter the URL in PhishGuard's SSL Checker and check three things: (1) The issuer should be a premium CA like DigiCert or GlobalSign — not Let's Encrypt. (2) The certificate should not be expired. (3) The domain in the certificate must exactly match the URL you typed — onlinesbi.sbi or hdfcbank.com — with no extra characters or hyphens.
A certificate name mismatch means the SSL certificate was issued for a different domain than the one you are visiting. For example, a phishing site at sbi-login.com might use an SSL certificate issued for a completely different domain. This is an almost certain sign of a phishing page. Do not proceed past this error.
Free SSL certificates from Let's Encrypt can be obtained in minutes by anyone — including scammers. The padlock icon only means your connection to that server is encrypted. It tells you nothing about whether the site itself is trustworthy or who owns it. This is why 'check for the padlock' advice is outdated and misleading in 2025.
Check the SSL certificate of any new or unfamiliar financial website before entering any credentials. For sites you use regularly like net banking, income tax portal, or EPFO, check the SSL certificate any time the site looks different from usual, or if you reached it via an SMS or WhatsApp link rather than typing the URL yourself.
Certificate Transparency (CT) is a public log of every SSL certificate ever issued. PhishGuard checks CT logs via crt.sh to see how recently a certificate was issued and whether the domain has a suspicious issuance history. Phishing sites typically have SSL certificates issued in the last 1–7 days before an attack campaign begins.
Yes. Enter the URL in PhishGuard's SSL Checker. The genuine IRCTC site (irctc.co.in) and the Aadhaar portal (uidai.gov.in) both use SSL certificates issued by the National Informatics Centre (NIC) or trusted government CAs. Any page claiming to be IRCTC or UIDAI with a Let's Encrypt or self-signed certificate is a phishing site.
Do not enter any credentials. Close the browser tab immediately. Navigate to your bank's website by typing the URL directly in the address bar rather than using any link. If the problem persists on the directly typed URL, call your bank's helpline. Report suspicious sites to CERT-In at incident@cert-in.org.in or call 1930.
Found a suspicious link? Scan it free with PhishGuard or report to India's national cyber crime helpline: 1930 · cybercrime.gov.in