SSL Checker

Expiry is the least interesting failure

Everyone monitors the expiry date, and it is genuinely the most common outage cause, but it is also the easiest to detect. The failures that persist are subtler: an incomplete chain that works in browsers but fails in curl and Java clients, a certificate valid for example.com but not www.example.com, or a server still offering TLS 1.0 to satisfy a client that retired years ago.

The intermediate chain problem

A certificate is validated by walking from the leaf up to a root the client already trusts, through one or more intermediates. Browsers often paper over a missing intermediate by fetching it from the AIA extension or reusing one they cached from another site, so a site can appear perfectly fine in Chrome and fail in every non-browser client. This produces the classic bug report of an API that works from a laptop and fails from a server, and it is why chain completeness must be checked with a tool that does not cheat.

Hostname matching lives in the SAN

Modern validation ignores the Common Name entirely and uses the Subject Alternative Name list. A certificate must list every hostname it serves, and a wildcard covers exactly one label: *.example.com matches www.example.com but not example.com itself, nor a.b.example.com. Both the apex and the wildcard must be listed for a site that serves both.

Short lifetimes changed the operational model

Certificate lifetimes have fallen from years to months, and the industry is moving shorter still. Manual renewal is no longer viable; ACME automation is the assumption. The practical consequence is that the thing to monitor is not the expiry date but whether renewal automation ran successfully, since a silently broken renewal cron gives you the same outage with less warning.

Protocol and cipher support

TLS 1.0 and 1.1 are deprecated and fail PCI requirements. TLS 1.2 remains acceptable with modern ciphers; TLS 1.3 is faster, since it completes the handshake in one round trip, and removes the weak options by design. Serving 1.2 and 1.3 only is the current sensible configuration.

What a checker cannot tell you

A valid certificate proves the connection is encrypted and the hostname matches. It says nothing about who runs the site: anyone can obtain a valid certificate for a domain they control, including a phishing domain. The padlock has never meant trustworthy, only encrypted.