SSL Checker

The most preventable outage on the internet

An expired certificate does not degrade gracefully. One morning the site simply becomes a full-screen browser warning — "Your connection is not private" — and effectively every visitor leaves. It has happened to banks, airlines and government services, not because the technology is hard, but because the expiry date lived in nobody's calendar. Certificates are also getting shorter: the industry is moving from 398-day maximum lifetimes toward 200, then 100, then 47 days, which means manual renewal quietly becomes a monthly chore with a outage attached to every miss.

The fix is boring: automate renewal (Let's Encrypt with a working auto-renew, as most cPanel accounts have) and monitor the days remaining anyway, because automation fails silently too — a changed CAA record, a broken DNS challenge, a full inbox nobody reads. A checker like this one tells you the current state; the monitored version warns you at 30, 14 and 7 days, every time, without anyone having to remember.

Expiry is not the only certificate problem

Name mismatch — the certificate does not list the hostname being visited, common after adding a subdomain or moving www vs non-www. Wrong issuer restrictions — a CAA record that forbids the CA your host uses, surfacing only at renewal time. Mixed chains — the certificate is valid but the intermediate chain is incomplete, which desktop browsers forgive and mobile devices do not. The results above cover the first two; a chain problem shows up as "works on my computer, broken on phones", and is fixed by reinstalling the certificate with its full chain bundle.

SSL Checker — frequently asked questions