How this SSL checker reads the certificate
Browsers deliberately hide certificate details from web pages, so this check runs on our edge function, /api/ssl. It resolves the domain with Cloudflare’s DNS-over-HTTPS, refuses private or internal addresses, then opens its own TCP connection to up to four of the site’s addresses and starts a TLS 1.2 handshake. In TLS 1.2 the server sends its certificate chain before encryption begins, so we can read the exact certificates it presents — the same bytes a browser receives — and parse them: names, dates, issuer, key, signature and extensions. Further short handshakes test whether TLS 1.3, 1.1 and 1.0 are accepted and whether RC4 or 3DES ciphers are still allowed. Nothing is decrypted and no session is completed.
Alongside that, a normal HTTPS request tests whether a standard client trusts the certificate, reads the HSTS header, and checks that plain http:// redirects to HTTPS. We look up DNS CAA records and ask crt.sh and SSLMate’s Cert Spotter, the public Certificate Transparency search services, for recent certificates covering the name. Both are free and occasionally slow or overloaded; if they fail you still get every live result.
Two honest limits. Sites behind Cloudflare can’t be reached by a raw connection from inside Cloudflare’s own network, so for them the trust check is real but the certificate details come from CT logs. And for a server that only speaks TLS 1.3 the certificate travels encrypted, so details again come from CT logs. The page tells you when that happens.
Reading the results
| Check | What a failure means | Fix |
|---|---|---|
| Trusted | Visitors get a full-page warning. | Use a certificate from a public CA such as Let’s Encrypt, Sectigo or DigiCert. |
| Name matches | The certificate is for a different name — often www versus the bare domain. | Reissue it with both names, or a wildcard. |
| Expiry | Under 21 days suggests automatic renewal is failing. | Check Certbot or your host’s renewal logs, then reload the server. |
| Chain complete | Some phones, apps and scripts fail even though desktop browsers work. | Install the full chain (fullchain.pem or the CA bundle). |
| TLS 1.0 / 1.1 | Deprecated since 2021 and a PCI DSS failure. | Allow only TLS 1.2 and 1.3. |
| HSTS / redirect | A first visit over http:// can be intercepted. | Redirect with 301 and send Strict-Transport-Security. |
A wildcard such as *.example.co.uk covers exactly one extra level: shop.example.co.uk but neither example.co.uk itself nor a.shop.example.co.uk. Use the “does it cover another name?” box under the chain to test any hostname. For response headers and redirect chains in detail, use the HTTP headers and redirect checker.
Certificate lifetimes are shrinking — automate renewal
Browser makers and certificate authorities agreed in 2025 (CA/Browser Forum ballot SC-081) to cut the maximum lifetime of public TLS certificates in stages: 200 days from 15 March 2026, 100 days from March 2027 and 47 days from March 2029. Let’s Encrypt certificates already last 90 days. Manual renewal once a year is over; if yours still involves copying files by hand, move to ACME automation (Certbot, acme.sh, Caddy, or your host’s built-in option) before the next cut.
Many CAs have also stopped running OCSP responders — Let’s Encrypt switched off OCSP in 2025 and relies on certificate revocation lists — so “no OCSP stapling” is no longer a fault. It is shown for information only. Mail servers need certificates too: choose port 465, 993 or 995 in the port list to check SMTPS, IMAPS or POP3S. Implicit-TLS ports are supported; STARTTLS on 25, 587 and 143 is not.
Common SSL errors and their causes
- NET::ERR_CERT_DATE_INVALID — expired, or the visitor’s clock is wrong. If this checker says the certificate is valid, the visitor’s device date is the problem.
- NET::ERR_CERT_COMMON_NAME_INVALID — name mismatch. Check whether the
wwwor bare domain is missing from the names list. - NET::ERR_CERT_AUTHORITY_INVALID — self-signed, a private CA, or a missing intermediate on a strict client.
- Cloudflare error 526 — Cloudflare can’t validate the certificate on your origin server. Install a valid certificate there or a Cloudflare Origin CA certificate with the SSL mode set to Full (strict).
- Works on one server, not another — load-balanced addresses with different certificates. The addresses table shows a fingerprint for each.
After renewing, reload the web server (sudo systemctl reload nginx) and run the check again — a new certificate on disk does nothing until the server reloads it. If the domain itself looks wrong, the DNS lookup shows which addresses the name points to.
Frequently asked questions
How do I check when an SSL certificate expires?
Enter the domain and press Check certificate. The summary shows how many days are left and the exact expiry date and time in UTC, taken from the certificate the server is presenting right now. You can then download a calendar reminder set for fourteen days before expiry, or copy the full report to send to whoever manages the site.
Why does my site work in Chrome but fail in some apps?
Usually a missing intermediate certificate. Desktop browsers quietly download it or have it cached, but many apps, older Android versions, curl, Python and Java do not. If the chain section shows only one certificate, or the checks say the chain is incomplete, install the full chain file supplied by your certificate authority and reload the server.
Is this as thorough as SSL Labs?
It covers what most people need — expiry, names, chain, trust, TLS 1.0 to 1.3, weak ciphers, HSTS, OCSP stapling and HTTP/2 — in seconds rather than minutes. SSL Labs goes further, enumerating every cipher suite and simulating dozens of old clients. For a quick installation check or monitoring renewals, this is faster; for a deep audit, use both.
Why are the details from Certificate Transparency for some sites?
Two cases. Sites behind Cloudflare cannot be reached by our raw connection because it also runs on Cloudflare, and servers that only speak TLS 1.3 encrypt the certificate. In both cases we still test trust with a real HTTPS request, and fill in the details from the public CT logs, which record every publicly trusted certificate.
Does the checker store the domains I look up?
No. The check runs in our edge function, which keeps nothing once it has answered. To complete the check it contacts the site itself, Cloudflare’s DNS-over-HTTPS resolver, crt.sh and Cert Spotter for Certificate Transparency and the HSTS preload list API. The domain appears in your browser address bar so you can bookmark or share the result.
Can it check mail server certificates?
Yes, for implicit-TLS ports: choose 465 for SMTPS, 993 for IMAPS or 995 for POP3S from the port list. Servers that upgrade a plain connection with STARTTLS on ports 25, 587 or 143 are not supported, because port 25 is blocked for our edge network and STARTTLS needs a mail conversation before the handshake.