What the SSL checker tests
We open a TLS connection to your server on port 443 and inspect what it presents, the same way a browser does before showing the padlock. Then we check how the server behaves with older protocol versions and whether plain HTTP is redirected to HTTPS.
- Certificate chain validity against standard trusted root certificates.
- Issuer, subject and whether the Subject Alternative Names cover your hostname.
- Days until expiry, with a warning under 30 days and a failure under 7.
- Negotiated protocol version, TLS 1.3 support and the cipher suite in use.
- Whether the deprecated TLS 1.0 and 1.1 are still accepted.
- OCSP stapling, key type and key size.
- Redirect from http:// to https://.
Why certificates still cause outages
Certificates expire by design, and their maximum lifetime is getting shorter: the CA/Browser Forum has agreed a schedule that reduces it in steps over the coming years. Automated renewal through ACME clients such as Certbot, or through your host, handles this — until a DNS change, a migrated server or an expired payment card silently breaks it.
When a certificate lapses, browsers show a full-page warning that most visitors will not click through. For a firm whose clients are asked to upload documents or pay invoices online, that is a lost day of trust. A quick monthly check, or this tool after any hosting change, catches the problem before clients do.
Old protocols and weak settings
TLS 1.0 and 1.1 were formally deprecated by the IETF in RFC 8996 and are no longer supported by current browsers. Leaving them switched on does not help any real visitor and may be flagged in client security questionnaires and penetration tests. Modern servers should offer TLS 1.2 and 1.3 only, with forward-secret cipher suites.
If the report shows a hostname mismatch, the certificate was issued for a different name — often example.com without www. or the other way round. Reissue it to cover both names.
Beyond the website
The same domain often serves more than the website: a client portal, webmail, a document upload page or a booking system on a subdomain. Each has its own certificate and its own expiry date. Run the checker on each hostname your clients use, and make sure renewal reminders go to a shared mailbox rather than to one person who may be on leave.