How this check works
The scanner opens a verified TLS connection using the domain for certificate name checking. It reads the issuer and validity dates only after trust verification succeeds. Connection failures remain unverified; an observed certificate-validation error is a confirmed finding.
Trust, name and dates all matter
A certificate must chain to a trusted authority, cover the requested hostname and be within its validity period. A certificate for another name does not become valid just because the server is reachable.
Renewal needs verification
Short certificate lifetimes make automatic renewal essential. An upcoming expiration is a prompt to verify that renewal is working, rather than proof that your renewal system has failed.
Common questions
Do you test every supported TLS version?
No. We report the protocol negotiated by one verified connection. We do not enumerate ciphers or deliberately attempt obsolete protocols.
Why can't I see dates for an invalid certificate?
We do not disable certificate verification to extract additional details. The report marks certificate validation as failed and the unavailable details as unknown.