SSL certificate check

Reading the result

• Valid until is the date that matters. Renewal should happen well before it, automatically.
• Names covered must include every name visitors use — with and without www, and any subdomain.
• The chain should have at least two certificates: the site’s and an intermediate. One on its own usually means the intermediate is missing.
• TLS 1.3 is current; 1.2 is fine; anything older is switched off in browsers.

Certificate errors, explained covers what each browser warning means and how to fix the cause.

How often does a certificate need renewing?

More often every year. Public certificates may last at most 200 days since March 2026, falling to 100 days in 2027 and 47 days in 2029. At that pace renewal has to be automatic; this check is how you confirm it is working.

What is an intermediate certificate?

Root authorities do not sign site certificates directly; an intermediate does, and the root vouches for the intermediate. The server must send the intermediate along with its own certificate, or clients that do not already have it cannot build the chain.

My browser says the site is fine, but an app fails. Why?

Usually an incomplete chain. Desktop browsers remember and fetch missing intermediates; phones, scripts, API clients and payment terminals often do not. This check does not fill gaps, so it sees what they see.

Does the check send anything to the site?

It opens a connection on port 443 and completes the TLS handshake, the way a browser starts a visit, then disconnects without requesting a page.

Why can’t I check an IP address or another port?

To keep the tool from being usable to probe networks: it connects only to public addresses, only on the HTTPS port, and only for a name you give it.