How this check works
A browser sees a site's certificate during the TLS handshake. Our checker runs on Cloudflare Workers, which cannot read that handshake directly, so it uses two other sources:
- Certificate Transparency logs. Every publicly trusted certificate must be published to CT logs before browsers accept it. We search them (via crt.sh, with Cert Spotter as a fallback) for current certificates that cover your hostname, including wildcards.
- A live HTTPS request. If the certificate were expired, self-signed or issued for the wrong name, the request would fail the way a browser does. We also request the
http://version to confirm it redirects to HTTPS.
Seeing several current certificates is normal. CDNs like Cloudflare often hold certificates from two authorities at once, and renewals overlap with the old certificate.
Why it matters
An expired certificate turns your site into a full-page browser warning, and almost every visitor leaves. HTTPS is also a confirmed, if small, Google ranking signal, and Chrome labels HTTP pages "Not secure".
Keeping certificates healthy
- Automate renewal. Let's Encrypt and Google Trust Services certificates last 90 days and are meant to renew automatically, around 30 days before expiry. Certificate lifetimes across the industry are shrinking, so manual renewal is getting harder to keep up with.
- Cover every hostname. The certificate's names (SANs) must include each hostname you serve, such as both
example.comandwww.example.com. - Redirect HTTP to HTTPS with a single 301, then send an HSTS header so browsers never try HTTP again.
- Check your CAA record. If you set one, it must list your certificate authority, or renewals fail. See it with the DNS lookup.
Check HSTS and other security headers with the HTTP header checker.