📜 SSL / TLS Check
Fetch the SSL/TLS certificate by hostname and inspect issuer, validity, Subject Alternative Names, and the full certificate chain.
📖 What this check tells you
The padlock appears only when three things hold at once: the certificate is in date, its issuer is trusted, and the domain matches. This check performs a real TLS handshake and inspects the certificate that comes back — expiry, issuer, the names it covers, and how the chain is put together. A site can look fine in your browser and still fail elsewhere if the chain is incomplete; that is the usual cause when older Android devices, curl, or server-to-server calls break while desktop Chrome is happy.
| Item | What it means | How to fix it |
|---|---|---|
| Expiry | Days remaining. Let's Encrypt certificates last 90 days, so if renewal has stopped you enter the warning zone after about 60. | With certbot, certbot renew --dry-run tells you whether the renewal path still works. Most failures are either port 80 being closed, so the HTTP-01 challenge cannot complete, or nginx never being reloaded after the renewal. |
| Certificate chain | The path from your certificate up to a trusted root. If you do not serve the intermediate certificate, only the clients that do not already have it cached will fail to verify. | In nginx, ssl_certificate must point at a file containing your certificate followed by the intermediates — fullchain.pem with certbot. Pointing it at cert.pem is the classic cause of this problem. |
| Name match (SAN) | The list of host names the certificate covers. Browsers read the SAN, not the CN. example.com and www.example.com are distinct names, so both have to be present. |
Reissue with every host listed: -d example.com -d www.example.com for certbot. A wildcard needs the DNS-01 challenge, and note that *.example.com does not cover example.com itself. |
| TLS version | TLS 1.0 and 1.1 are deprecated and disallowed under PCI DSS. 1.2 is the floor; 1.3 is current. | On nginx, narrow it to ssl_protocols TLSv1.2 TLSv1.3;. That does cut off old clients, so check the User-Agents in your access log before you decide. |
Browsers cache intermediates they have seen before, so an incomplete chain often will not reproduce on your own machine. The reliable test is to look at whether the intermediate appears in the output of openssl s_client -connect example.com:443 -servername example.com.