How it works
Every 30 minutes, we connect to your site over HTTPS and inspect the certificate it presents:
- Trust: the certificate must be signed by a trusted authority through a complete chain, and must not be self-signed.
- Hostname: the certificate must cover your monitor's host name.
- Expiry: we tell you how many days are left and warn you before the certificate expires. Intermediate certificates are checked as well.
- Strength: RSA keys shorter than 2048 bits and weak signature algorithms (such as SHA-1) are flagged.
- Changes: when the certificate is replaced, the summary tells you what changed: the issuer, and the names that were added or removed.
The report shows the certificate's details: issuer, validity dates, covered names, key and fingerprint.
Settings
| Setting | Default | What it does |
|---|---|---|
| Warning days | 14 |
Warn when the certificate (or an intermediate) expires within this many days. |
Statuses
| Status | Meaning |
|---|---|
| OK | The certificate is valid, trusted and covers your host, with more than the warning days left. |
| Warning | The certificate expires soon, or it has a weak key or signature. |
| Failed | The site is not served over HTTPS, the certificate has expired, is untrusted, does not cover the host, or the TLS handshake failed. |
By default you are notified of warnings and failures.
Fixing common problems
- Expires soon: if you use Let's Encrypt or another automated provider, renewal should already be scheduled. Check that the renewal job is running and that the web server reloads the new certificate.
- Chain is incomplete: the server must send the intermediate certificates as well as your own. Configure the full chain (
fullchain.pemwith Let's Encrypt) instead of the certificate alone. - Does not cover the host: request a certificate that includes this exact host name, such as both
example.comandwww.example.com. - Self-signed: replace it with a certificate from a public authority. Let's Encrypt certificates are free.