SSL Certificate Check: Expiry, Chain and TLS

What this check tells you

It reads the certificate your server sends during a TLS 1.2 connection and reports its expiry date, the names it covers, its issuer and the chain, plus whether TLS 1.0 or 1.1 is still accepted.

Certificate expiry: expired or not yet valid (high), expiring within 14 days (medium) or within 30 days (low). Most certificates are renewed automatically about 30 days before they expire, so a certificate this close to expiry often means renewal is failing.
Name and chain: whether the certificate's Subject Alternative Names cover the hostname (a wildcard covers exactly one label), whether it's self-signed, whether the server sends the intermediate certificate, and whether anything it sends has expired.
Legacy TLS versions: TLS 1.0 and 1.1 are deprecated (RFC 8996). If the server still accepts them, it's flagged as medium.

Who it's for

Site owners and developers who want to catch a certificate problem before visitors see a browser warning, check a renewal after it happens, or confirm a server change hasn't re-enabled old protocols.

What you enter, and what happens

Just the domain. The scanner looks up its public address and refuses private or reserved addresses. It then opens a TLS connection to port 443, offering only TLS 1.2, so the certificate is sent unencrypted. It reads the certificate and closes the connection before the handshake completes. A second short connection offers at most TLS 1.1 to see whether the server accepts it. No data is sent, and nothing is stored.

How to read the result

Passed means the certificate was read and none of the conditions above applied. The evidence shows the subject, issuer, serial, validity dates, names and key type.
Issue found comes with a fix, for example installing the full-chain file instead of the certificate alone, or setting the minimum TLS version to 1.2.
Could not complete means the certificate couldn't be read. This is never shown as a pass. See the next section.

Limits

Sites behind Cloudflare: our scanner runs on Cloudflare Workers, which can't open direct connections to Cloudflare's own network. For those sites, and for servers that only accept TLS 1.3 (which encrypts the certificate), the checks report "could not complete". The expiry check then shows the most recently logged certificate from public Certificate Transparency logs (crt.sh), labelled as such. That certificate may not be the one the server sends.
Trust isn't validated: the chain check confirms completeness and dates. It doesn't verify signatures against a browser's trusted root store, so we never describe a certificate as "trusted".
One address: the first public IPv4 address (or IPv6 if there's none) is checked. Other addresses serving the same name may present different certificates.
SSL 3.0 and individual cipher suites aren't tested separately.

Questions

My certificate renews automatically. Why does it say it expires soon?

The check reports the certificate the server is sending now. If renewal ran but the server wasn't reloaded, or renewal failed, the old certificate is still served. Check your host's SSL settings or your ACME client's logs, then run the check again.

What does "the server doesn't send the intermediate certificate" mean?

Your certificate was issued by an intermediate certificate authority. Servers should send that intermediate along with your certificate. Desktop browsers often repair a missing one, but many phones, apps and API clients fail with a certificate error. Configure the server with the "full chain" file from your certificate provider.

Does a passing result mean my HTTPS setup is secure?

It means the certificate checks found no problem. HTTPS redirects and HSTS are checked separately in the same report, and many aspects of TLS configuration aren't checked at all. See what we check.