Skip to content
WebAuditOS
Start free audit

Test your website now

Free, no card. We read only public pages.

Run free audit →

HTTPS and TLS

What is an SSL certificate, and how do you check yours?

An SSL certificate proves your site's identity and enables HTTPS. The types, how long they last, how to check one, and why renewal is where sites break.

An SSL certificate, technically a TLS certificate, is a file issued by a trusted certificate authority that proves a server is allowed to represent a domain, and lets browsers set up an encrypted HTTPS connection. Most sites use free, automatically renewed domain-validated certificates. Check its expiry date, the names it covers and that the server sends the full chain.

Published · Last updated

By Michal Měřínský. Audit methodology.

What a certificate is

A certificate binds a domain name to a public key, signed by a certificate authority that browsers trust. When a browser connects, the server presents the certificate, the browser checks the signature chain back to a trusted root, checks the name and the dates, and only then continues. If any check fails, visitors see a full-page warning.

The types

  • Domain validated (DV): proves control of the domain. Issued in minutes, often free. This is what most sites use.
  • Organization validated (OV) and extended validation (EV): include checked company details. Browsers no longer show them differently in the address bar, so for most sites they add cost without visible benefit.
  • Wildcard: covers all subdomains one level down, such as *.example.com.
  • Multi-domain: lists several names on one certificate.

How long they last

Validity periods keep shrinking. Under the CA/Browser Forum's rules, the maximum lifetime of a publicly trusted certificate began falling in March 2026 and is scheduled to reach 47 days by 2029. Let's Encrypt certificates have long lasted 90 days. The practical conclusion is simple: manual renewal no longer works. Renewal has to be automatic and monitored.

How to check yours

Click the padlock in the browser for a quick look, or check from the command line:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -subject -ext subjectAltName

Check three things:

  • The expiry date, and whether automatic renewal is set up.
  • The names in subjectAltName: every hostname visitors use must be listed, usually both the bare domain and www.
  • The chain: the server must send the intermediate certificate, not only its own.

Where it goes wrong

  • Renewal fails silently after a DNS, hosting or firewall change, and the certificate expires weeks later.
  • The www or bare domain is missing from the certificate.
  • The intermediate certificate is not served, so some devices fail while your browser works.
  • A load balancer or CDN serves an old certificate after the origin was renewed.

Most certificate outages are renewal outages. Monitor expiry with an alert that reaches a person well before the date.

What a scan can and cannot tell you

WebAuditOS checks that the certificate is valid and trusted with a complete chain, warns when expiry is approaching, records the TLS version negotiated and checks that the site is served over HTTPS.

It sees the certificate served to its own connection from one location. Certificates on other hostnames, subdomains or regional CDN nodes need their own checks.

An expiry warning is worth more than a pass today. It gives advance notice of a specific risk, without proving renewal will fail.

Short answers

Do I need to pay for a certificate? Usually not. Free DV certificates are trusted by every browser.

How long does a certificate last? Lifetimes are shrinking toward 47 days, so automate renewal.

What does the padlock mean? The connection is encrypted and the certificate is valid. It does not vouch for the site's honesty.

Does a certificate cover subdomains? Only the names listed on it, or one level of subdomains for a wildcard.

In the product

The checks this maps to

Every check named here runs on every scan, on every plan - what a plan changes is how many pages are crawled, how long the history is kept and what you can do with the result. These are the ids the findings carry, so you can match a line in a report to the explanation above.

HTTPS and TLS

Why does Chrome say your connection is not private?

The warning means the browser could not verify the site's certificate. What each NET::ERR_CERT code means, what visitors can do, and how owners fix it.

HTTPS and TLS

SSL vs TLS: what is the difference?

SSL is the old, insecure predecessor of TLS, but the name stuck. Which versions are safe today, what an SSL certificate really is, and how to check your server.