Check a site's SSL/TLS certificate
An SSL/TLS certificate is what lets a browser trust a site's HTTPS. When it expires, is issued for the wrong hostname, or has a broken chain, browsers throw a full-page warning, and most visitors leave rather than click through it.
What a fail costs
On CheckWeb this is a weight-3 check on the Security axis and a critical gate: an invalid, expired, or untrusted certificate caps the overall score at 50 out of 100, whatever else the site does well. A certificate that visitors' browsers refuse is close to being down, and the score treats it that way.
How it looks in the report
Under the Security axis, "TLS certificate validity". A healthy site shows PASS with "Valid; expires in N days", and the exact expiry date and issuer in the evidence chip. An expiring certificate is flagged before it lapses, so a renewal can happen ahead of an outage; an invalid one caps the score.
TLS certificate validity
Valid; expires in 68 days
expires 2026-09-26 · Let's Encrypt
Broken vs valid
Broken
Expired, self-signed, issued for a different hostname, or missing an intermediate in the chain. The browser blocks the page.
Valid
A trusted certificate that covers the hostname served, with comfortable time before expiry.
How to fix it
- Renew before expiry, and automate it (certbot or another ACME client) so it never lapses.
- Make sure the certificate covers the exact hostname served, including the www or bare-domain form visitors actually reach.
- Serve the full chain, intermediate included, not just the leaf certificate.
- Verify: re-scan and confirm the new expiry date.
Check a site's SSL certificate
Paste a URL to see whether a site's certificate is valid, when it expires, and who issued it. Fix, re-scan, confirm.
Check my website