SSL and TLS Are Not Quite the Same Thing
People still say SSL certificate, but modern HTTPS uses Transport Layer Security (TLS). An X.509 certificate connects a public key with an identity. During a TLS handshake, the browser evaluates that certificate and the server proves it controls the corresponding private key.
TLS helps authenticate the server and protect traffic, but it does not guarantee that the website or its content is legitimate.
Check the Exact Hostname Visitors Open
- Identify the address: note whether visitors use
example.com, www.example.com or a distinct subdomain such as shop.example.com.
- Submit the hostname: use the checker’s supported input format and start a check. Do not assume that scanning the root domain automatically covers its subdomains.
- Read the returned details: if available, inspect the expiry date, issuing authority, certificate names and any reported warnings.
- Repeat for important names: check the
www and non-www versions separately, along with customer-facing applications and API endpoints.
- Verify after a change: repeat the check after renewal or hosting changes and confirm that the public endpoint now serves the intended certificate.
Input formats and optional checks vary between tools. Do not assume this interface accepts URLs, custom ports or extra diagnostics without live verification.
What Certificate Fields Actually Mean
A particular checker may show only some of these fields. A basic expiry lookup is not necessarily a complete trust-chain, revocation or TLS-configuration test.
Read Expiry Dates Carefully, Not Just the Countdown
Validity depends on exact timestamps, not just dates. A certificate with notAfter set to 2026-11-30 12:00 UTC expires at that instant, regardless of the viewer’s timezone.
Use a 30-day warning as a review trigger, not a universal failure rule. Manual renewals may need more lead time than automated ones. If the display says zero days remaining, check the precise expiry time.
Why a Valid Certificate Can Still Show a Name Error
Browsers match DNS hostnames against the certificate’s Subject Alternative Names, not the legacy Common Name. RFC 9525 confirms this rule. A certificate for example.com does not automatically cover www.example.com.
The wildcard *.example.com matches shop.example.com, but neither example.com nor api.shop.example.com.
A redirect does not bypass certificate checks. The browser must establish valid HTTPS at example.com before receiving a redirect to www.example.com.
Understand Trust Chains and Intermediate Certificates
An unexpired certificate needs an acceptable trust path to a trusted root. Servers commonly send a leaf certificate and intermediate CA certificates; clients normally hold trusted roots.
Missing intermediates can explain why HTTPS works on one device and fails on another, especially when clients have different caches. Inspect the chain served publicly. Self-signed and private-CA certificates are not automatically trusted by public browsers.
Check the Certificate Served by Your CDN and Origin
A CDN or reverse proxy can create two TLS connections: visitor to edge, and edge to origin. Each may use a different certificate.
A public checker typically sees the edge certificate, not the private origin certificate. Check both connections through the appropriate public endpoint and hosting or CDN controls.
If visitors still receive the old certificate, investigate server reloads, virtual hosts, load balancers and CDN deployment.
Public Certificate Lifetimes Changed in 2026
CA/Browser Forum rules shortened the maximum validity of newly issued public TLS certificates from 15 March 2026. Actual certificates may have shorter lifetimes.
The limits apply at issuance; older valid certificates remain usable until expiry. Private CAs are not automatically subject to these public-web limits. Issuers are advised to leave headroom below each maximum.
Renewal Is Not Finished Until the New Certificate Is Live
Renewal requires issuance, installation and verification. A successful renewal job does not help if a server or proxy still serves the old certificate.
Record certificate ownership, automate renewal where possible and retest externally after deployment. Monitor expiry so failed challenges, file permissions or service reloads are discovered before visitors see warnings.
Match Common Errors to the Next Diagnostic Step
For shared hosting, the server may use Server Name Indication (SNI) to choose the right certificate for a hostname. A low-level connection made without SNI can receive a default certificate that ordinary browsers would not see. Check the same hostname and connection conditions your users rely on.
What an Expiry Check Does Not Test
An unexpired certificate does not prove the site uses strong TLS settings, avoids mixed content, enforces HTTPS or resists malware. Revocation, certificate transparency and cipher vulnerabilities require separate checks unless this interface explicitly reports them.
For SEO, certificate problems can obstruct visitors and crawlers. Treat HTTPS validity as an accessibility prerequisite, not a ranking shortcut. Fix browser warnings before lower-priority optimization work.
Frequently Asked Questions About SSL Certificate Checks
How do I check when my website’s SSL certificate expires?
Check the exact HTTPS hostname and read the certificate’s notAfter timestamp. If available, compare the reported days remaining with your renewal schedule and repeat the check after deployment.
Does HTTPS mean that my certificate is valid?
No. A URL beginning with https:// requests a TLS connection; the connection can still fail because of expiry, name mismatch or an untrusted certificate chain.
Do I need certificates for both www and non-www domains?
Both names need valid HTTPS coverage if people connect to both, even when one redirects to the other. One certificate can cover multiple names through appropriate SAN entries.
Why is my renewed certificate still showing as expired?
The replacement may not have reached the active web server, CDN or load balancer. Check the live public certificate and the deployment paths, not just the renewal confirmation.
Can I use a wildcard certificate for every subdomain?
No. A wildcard such as *.example.com matches only one subdomain label. It does not cover the apex domain or additional nested labels unless separately listed.
Will an SSL checker tell me whether my website is completely secure?
No. Certificate inspection can identify certain HTTPS identity and expiry problems. Application security, TLS configuration, content integrity and server hardening require additional testing.
