SSL Check

What you can read from an SSL certificate

An SSL/TLS certificate is the cryptographic identity card of a website. It binds a public key to a domain and is signed by a certificate authority (CA). The most important fields our check reads for you:

• Subject — the domain (or domains via Subject Alternative Name) the certificate is valid for.
• Issuer — the CA that issued it (e.g. Let's Encrypt, DigiCert, Sectigo, GlobalSign).
• Valid From / To — issue and expiry dates. Let's Encrypt certificates typically expire after 90 days; commercial ones after 12 months.
• Public Key Algorithm + Length — RSA 2048 bits or ECDSA P-256 are today's standard. Anything below RSA 2048 is insecure.
• Signature Algorithm — SHA-256 is standard. SHA-1 has been rejected by browsers since 2017.
• SAN (Subject Alternative Name) — the list of all domains the certificate covers. Wildcards appear as e.g. *.example.com.

TLS versions — what's acceptable today?

Browsers today only accept TLS 1.2 and TLS 1.3. TLS 1.3 is the modern variant with better performance and a smaller attack surface. SSLv2, SSLv3, TLS 1.0 and TLS 1.1 have been disabled in all mainstream browsers since 2020 and are considered insecure. If your web server config still offers old versions, switch them off immediately — they help nobody and create downgrade-attack surface.

What to do when a certificate expires

With Let's Encrypt, renewal is automatable via Certbot or any ACME client — typically every 60 days. If the automation breaks, the cause is almost always a DNS or web-server misconfiguration: the HTTP-01 challenge fails because port 80 is blocked, or DNS-01 fails because the API token is missing. For commercial certificates, renewal usually happens through the CA dashboard with a new CSR.

Practical use cases

You want to verify a fresh certificate was deployed cleanly before a migration. You saw a browser warning and need to identify the cause (expired? wrong CN? wildcard not covering?). You're running a security audit on your own infrastructure. For deeper background, see our article SSL Certificates Explained and the glossary entry on TLS/SSL.