SSL/TLS Certificate Check

SSL/TLS certificate check

Is this server's certificate valid, trusted and issued for the name I use?

The certificate must match this exact name, so www.example.com and example.com are checked separately.

How this check works

The check does two separate things and labels each one.

  1. Live connection. Our server connects to the host name over HTTPS, on port 443 or 8443, with full certificate verification, the same way a browser does. If the connection succeeds, the certificate the server presented is valid for that name, unexpired, and chains to a trusted root.
  2. From Certificate Transparency logs. The name is looked up in the public Certificate Transparency logs, where every publicly trusted certificate authority must record the certificates it issues. From those logs it shows the newest certificate issued for the name: issuer, validity dates, days remaining and the names it covers, plus the issuing chain.

The two can differ. The logs show the newest certificate issued, which may not yet be the one the server presents. If the dates in the logs look fine but the live connection fails, the server is probably still using an older certificate.

How to read the results

  • Trusted connection, plenty of days left: nothing to do.
  • Under 14 days remaining: renew now. Automated renewal (ACME) normally renews at 30 days left, so this often means automation has stopped.
  • Connection failed: the certificate may be expired, issued for a different name, missing an intermediate certificate, or the server may not listen on that port. Test with openssl s_client -connect host:443 -servername host for the exact error.
  • Name mismatch: the certificate's subject alternative names don't include the name you checked. Wildcards cover one level only: *.example.com covers www.example.com but not example.com or a.b.example.com.

Why certificate lifetimes are getting shorter

Public certificates are being limited to shorter lifetimes in stages, and fall to 47 days in 2029 under the CA/Browser Forum's schedule. Manual renewal won't keep up; automate it with ACME.

Updated 27 October 2026

Related checks

FAQ

Why does the live check fail when the dates in the logs look fine?

The logs show the newest certificate issued for the name; the server may still be presenting an older one. The same failure appears when a certificate is expired, was issued for a different name, is sent without an intermediate certificate, or when nothing is listening on the port you chose.

What is a Subject Alternative Name (SAN)?

SANs are the list of host names a single certificate covers. Modern certificates usually include the apex domain and the www subdomain, and may include wildcard entries like *.example.com.

What happens when a certificate expires?

Browsers show a 'Your connection is not private' warning to every visitor. Certificate authorities email the contact on the certificate 30, 14 and 7 days before expiry, and ACME automation normally renews at 30 days left.