How the certificate check works
The checker resolves your hostname, validates its public addresses and connects to one address on port 443 using the hostname for TLS Server Name Indication. A diagnostic handshake reads the presented certificate. A separate verified handshake checks the certificate using this server’s trust store. No login information or HTTP request is sent to your website.
Understanding validity and hostname results
The validity period is the interval between the certificate’s start and expiration dates. Negative remaining days mean it has expired. Hostname coverage uses DNS Subject Alternative Names; a wildcard such as *.example.com covers one label, such as www.example.com, but not example.com or a.b.example.com. Trust verification can fail because of an incomplete chain, an untrusted issuer, a name mismatch or invalid dates.
Troubleshooting a failed check
Confirm that the hostname resolves correctly and that HTTPS is listening on port 443. Review the certificate and intermediate certificates installed at your web server or CDN. Renew expired certificates through the issuing service. If you use multiple addresses or a CDN, test the provider configuration as well: one successful connection does not prove every edge has the same certificate. Revocation and browser-specific policy checks are outside this tool’s scope.