What this checks
- Trust: whether the certificate chain leads to a certificate authority that this server trusts, which is the same public list browsers and operating systems use.
- Name: whether the certificate covers the name you entered. Certificates list the names they are valid for (the “subject alternative names”); a wildcard such as
*.example.comcovers one level of subdomain, notexample.comitself. - Dates: when it became valid, when it expires and how many days are left.
- Chain: the certificates the server sends. It should send its own certificate followed by the intermediates; a missing intermediate is a common reason a site works in one browser and fails in an app.
- Key, signature and TLS version: weak keys, SHA-1 signatures and outdated TLS versions are flagged.
Common problems and fixes
- Expired or about to expire: renew it. Free certificates from Let’s Encrypt last 90 days and are renewed automatically about 30 days before they expire, so one with fewer than 21 days left usually means renewal is failing.
- Name does not match: the site answers with a certificate for another name, often the hosting provider’s default. Add the name to the certificate, or check the server’s configuration for that domain.
- Incomplete chain: configure the server with the “full chain” file rather than the certificate alone.
- Self-signed: fine for testing, but browsers warn visitors. Use a certificate from a public authority.
Mail servers can be checked on their TLS ports (465, 993, 995). Ports that start in plain text and upgrade with STARTTLS (25, 587, 143, 110) are not supported.
Privacy
The name you enter is sent to this site, whose server connects to it, completes a TLS handshake to read the certificates, and closes the connection without sending anything else. Only public internet addresses are reached. The result is kept for about two minutes.