SSL certificate checker
We open a TLS handshake to the site from our servers and report what the certificate says: Who issued it, which names it covers, the protocol negotiated, and precisely how long before browsers start refusing the site outright.
Why an expired certificate looks exactly like an outage
An HTTPS certificate is a time-limited statement, signed by an authority your browser already trusts, that a particular public key belongs to a particular hostname. Browsers check three things before they will render a single byte: That the signature chains to an authority they trust, that today’s date falls between the certificate’s two dates, and that the hostname you typed is one the certificate covers.
If any of those fails, the browser stops. It does not degrade to plain HTTP, and it does not show the page with a warning bar. It shows a full-page interstitial that most people read as "this website is broken". Meanwhile the web server is running, the DNS is correct and the database is happy - Which is why this failure so often takes hours to identify. Everything anybody thinks to check looks fine.
The three ways it usually happens
- Automated renewal stopped working weeks ago. Most certificates now last 90 days and renew automatically. When the renewal breaks it is silent, and the site keeps working for the remainder of the term. The outage lands up to three months after the actual fault, long after whatever change caused it.
- The new certificate was issued but never loaded. Renewal succeeded and wrote the files; nothing reloaded the web server, so it is still serving the old one from memory. The fix is a reload, and it takes seconds once somebody realises.
- The certificate does not cover the name people use. A certificate for
example.comdoes not automatically coverwww.example.com. Half the visitors get through and half do not, which makes the reports look random.
Reading the expiry figure
Certificate failures are one of the two ways a perfectly healthy server stops serving anyone; the other is DNS, and our checker tells you which of the two you are looking at in one request. Anything under 15 days on a certificate that is supposed to renew automatically means the automation has probably already failed - A healthy renewal typically happens with about a third of the term remaining. A figure under 8 days is worth treating as an incident in progress rather than a reminder.