Check a certificate
What gets checked
Why certificate expiry keeps causing outages
Certificates fail closed. When one expires the site does not degrade gracefully — browsers refuse the connection outright and show a full-page security warning, and API clients stop working entirely. Because renewal is usually automated, the failure mode is silence followed by a sudden total outage, typically on a host everyone forgot was issuing its own certificate.
Validity periods have also been shortening. Ninety days is now the norm rather than the exception, and the industry is moving shorter still, which means renewal has to be automated and monitored rather than diarised. Checking the days remaining across an estate periodically catches the host where automation quietly stopped working.
Reading the issuance history
The certificate history is often more revealing than the current certificate. A domain that has issued through one authority for years and suddenly shows a certificate from a different one is worth a second look — that is either a migration nobody mentioned or, less often, an issuance that should not have happened. Certificate Transparency exists precisely so that mis-issuance is visible to the domain owner rather than only to whoever requested it.
The list of covered names is worth reading too. A certificate covering a dozen unrelated hostnames tells you those services share infrastructure, and a wildcard means one private key protects everything under the domain.
The honest caveat
Certificate Transparency records what was issued, not what a given server is currently presenting. Almost always these match. They can diverge if a certificate was issued but never deployed, if a server is presenting an older certificate than the newest one issued, or if different hosts behind a load balancer are serving different certificates. The live HTTPS check confirms that a working certificate is being served; for byte-level inspection of the exact certificate a specific server presents, a direct TLS handshake tool is the right instrument.
Questions
Does this connect to my server?
It makes one ordinary HTTPS request to the homepage, the same as a browser visit, to confirm HTTPS responds and to read the HSTS header. Everything else comes from public Certificate Transparency logs.
Why does it show certificates I did not order?
Certificates for a domain can be issued by any service the domain is connected to — a CDN, a hosting platform, a load balancer — each of which requests its own. Several issuers for one domain is normal. An issuer you cannot account for at all is worth investigating.
What does the wildcard flag mean?
That the certificate covers *.example.com rather than named hosts. Convenient, but it means a single private key secures every subdomain, so a compromise anywhere is a compromise everywhere.
Nothing was found for my domain.
Either no publicly trusted certificate has ever been issued for it, or the CT provider is rate limiting. Domains using only internal certificate authorities do not appear in public logs.
More in this category
What to run next
The checks people most often reach for alongside this one.
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace and Microsoft 365 inboxes
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.