How the check works
Our server opens a TLS connection to the site (sending its name via SNI, as browsers do), reads the certificate and chain it presents, and checks them against a standard set of trusted certificate authorities.
Common certificate problems
- Expired certificate — renew it; automate renewal (for example with Let's Encrypt) to avoid repeats.
- Hostname mismatch — the certificate doesn't list the name you visited; add it to the certificate's names (SANs).
- Incomplete chain — the server doesn't send the intermediate certificate; some devices then reject it.
- Old TLS versions — TLS 1.0 and 1.1 are deprecated; TLS 1.2 or 1.3 should be used.
Questions
How early should I renew a certificate?
Automated renewals typically run 30 days before expiry. This tool flags certificates with fewer than 14 days left.