SSL certificate check

The fields that matter

• Valid until / days left — when the certificate expires. Browsers block the site with a full-page warning after that.
• Names (SAN) — every name the certificate covers. If visitors use both example.com and www.example.com, both must be listed.
• Issuer and type — who issued it, and whether it is Domain, Organisation or Extended Validation.
• Key — RSA 2048-bit or larger, or ECDSA P-256, are the norm today.
• TLS versions — TLS 1.2 and 1.3 are current; TLS 1.0 and 1.1 are retired and should be turned off.
• CAA — DNS records that say which certificate authorities may issue for the domain. Optional, but they stop other CAs from issuing by mistake.

Certificates are getting shorter-lived

Under the CA/Browser Forum’s 2025 decision, the maximum certificate lifetime drops to 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029. Manual yearly renewals won’t keep up — use automatic renewal (ACME / Let’s Encrypt, or your host’s or CDN’s managed certificates).

Common errors

• Expired — renew it and fix automatic renewal.
• Name mismatch — the name typed isn’t in the SAN list.
• Incomplete chain — the server doesn’t send the intermediate certificate, so some browsers and apps trust the site and others don’t. Install the full chain the CA provides.